EasyIO FS32 EUVD-2026-91070

Exploitation requires access to the EasyIO FS32's on-chip debug and test interface (CWE-1191, e.g. a JTAG/SWD-style hardware debug/test port) that is not adequately access-controlled, and additionally depends on user interaction (CVSS UI:A) to reach the exploitable condition. The vector's high attack complexity (AC:H) indicates non-trivial prerequisites must be met. Affected only on EasyIO FS32 firmware before 3.3b63; upgrading to 3.3b63 or later removes the exposure. Primary limiting factors: the hardware debug-interface dependency typically implies local or physical reachability despite the AV:N label, the mandatory user interaction, and the high complexity - all of which constrain opportunistic remote abuse.

This is a moderate-severity (CVSS 4.0 base 7.2) information-exposure/availability flaw in the Johnson Controls EasyIO FS32 building-automation controller, rooted in an improperly protected on-chip debug/test interface (CWE-1191). The signals are internally inconsistent and should be verified with the vendor before prioritization. The vendor-supplied CVSS 4.0 vector claims a network attack vector (AV:N) with high attack complexity (AC:H) and required user interaction (UI:A), yet CWE-1191 (on-chip debug and test interface) describes a hardware-level interface (e.g., JTAG/SWD) that normally requires local or physical adjacency - CVSS indicates network vector but the weakness class implies local/physical access; verify with vendor. The impact split is also unusual: the vector reports no confidentiality impact on the vulnerable system (VC:N) while subsequent-system confidentiality is high (SC:H) and the issue is tagged 'Information Disclosure'/'Collect Data from Common Resource Locations' - this tension between VC:N and an information-disclosure classification should be reconciled. No EPSS score, CISA KEV listing, or public proof-of-concept was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Combined with high attack complexity, required user interaction, and the likelihood of needing proximity to a debug interface, real-world risk is meaningfully lower than the 7.2 base score suggests for most deployments; treat as a scheduled-patch item rather than an emergency unless devices are physically exposed.

An attacker with access to the EasyIO FS32's exposed on-chip debug/test interface, and relying on a user action to reach an exploitable state, interacts with the debug interface to read data from common resource locations and degrade device/system availability. Given high attack complexity and required user interaction, this is not a point-and-click remote exploit; no public proof-of-concept was provided. Realistically this affects controllers that are physically accessible or whose debug interface is reachable in the deployment environment.