Easyio Fg
Monthly
Password spraying attacks against EasyIO FG controllers running firmware before 2.0b52 can succeed due to hard-coded credentials (CWE-798), enabling unauthenticated remote attackers to bypass authentication and potentially achieve high integrity and availability impact with low confidentiality impact. Affected devices are those with firmware versions prior to 2.0b52, and exploitation requires use of a vendor hard-coded credential and access to the controller's management interface, which may be exposed via BACnet/IP, web, or integration ports. This is a moderate-priority, context-dependent issue rather than an internet-wide emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H.
Password spraying attacks against EasyIO FG controllers running firmware before 2.0b52 can succeed due to hard-coded credentials (CWE-798), enabling unauthenticated remote attackers to bypass authentication and potentially achieve high integrity and availability impact with low confidentiality impact. Affected devices are those with firmware versions prior to 2.0b52, and exploitation requires use of a vendor hard-coded credential and access to the controller's management interface, which may be exposed via BACnet/IP, web, or integration ports. This is a moderate-priority, context-dependent issue rather than an internet-wide emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H.