Easyio Fs32
Monthly
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
Hard-coded cryptographic key in Johnson Controls EasyIO FS32 building automation controllers before firmware 3.0b63 permits unauthenticated remote retrieval of embedded sensitive data, as the identical key is embedded in firmware and recoverable from any device or firmware image. Network reachability to the controller is required, and because these OT devices are often segmented, practical exploitation may depend on prior access to the building-management network. No public exploit identified at time of analysis, and the vendor has released firmware 3.0b63 to remove the hard-coded key; our independent assessment rates the confidentiality-only impact at CVSS 3.1 7.5 despite the record's CVSS 4.0 score of 9.3.
OS command injection in Johnson Controls EasyIO FS32 building-automation controller firmware before 3.0b63 allows an attacker who holds high-privilege credentials and can reach the device from an adjacent network segment to execute arbitrary operating-system commands, resulting in full compromise of the controller (CVSS 7.2; the vendor-assigned CVSS 4.0 vector carries an E:P exploit-maturity metric, i.e. proof-of-concept level). No confirmed active exploitation is indicated and no public exploit is identified at time of analysis - the CVE is not in CISA KEV - so the principal real-world gating factors are the PR:H authentication requirement and the AV:A adjacent-network position rather than weaponized, internet-facing exploitation. Defenders should treat the device as high-value OT infrastructure, since a compromised building-automation controller can be pivoted into the wider BAS/BMS network.
Authentication abuse in Johnson Controls EasyIO FS32 building-automation controllers running firmware earlier than 3.0b63 lets an attacker who already holds privileged access on the adjacent network leverage an insecurely initialized default resource to subvert authentication, with assessed consequences spanning integrity and availability of the controller and knock-on effects at system scope. Exploitation is heavily gated: the attacker must sit on the adjacent/local network (AV:A, not internet-reachable), must already be privileged (PR:H), must clear high attack complexity (AC:H) and a specific attack requirement (AT:P), so this is realistically reachable only by someone with an existing foothold on the building-automation network, not by an unauthenticated remote actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is 5.6 (medium).
Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 expose a file/path-handling function to externally controlled input (CWE-73), allowing a high-privileged, authenticated attacker with adjacent-network access to supply crafted file names or paths and reach files outside the intended location, with the potential to read sensitive data and to overwrite or corrupt files that affect device integrity and availability. Exploitation is constrained: it requires a foothold on the OT/building-automation network segment (CVSS AV:A), an elevated privileged session on the device (PR:H), a specific attack prerequisite (AT:P), and a high-complexity sequence (AC:H), yielding a base score of 5.6 under CVSS 4.0 and an assessed CVSS 3.1 vector of AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a genuine but non-urgent issue whose practical risk is materially lower than the path-traversal label alone suggests.
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Hard-coded credentials in Johnson Controls EasyIO FS32 firmware before 3.0b63 allow an attacker with adjacent-network access to use embedded login secrets and cause a high availability impact on the controller; the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only availability affected (C:N/I:N/A:H). This is not remotely internet-exploitable, the vendor notes an additional precondition (CVSS 4.0 AT:P), and no public exploit identified at time of analysis, making it a moderate, context-dependent risk. Johnson Controls lists the fix as EasyIO FS32 firmware 3.0b63 and later, with the advisory at its trust center.
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
Hard-coded cryptographic key in Johnson Controls EasyIO FS32 building automation controllers before firmware 3.0b63 permits unauthenticated remote retrieval of embedded sensitive data, as the identical key is embedded in firmware and recoverable from any device or firmware image. Network reachability to the controller is required, and because these OT devices are often segmented, practical exploitation may depend on prior access to the building-management network. No public exploit identified at time of analysis, and the vendor has released firmware 3.0b63 to remove the hard-coded key; our independent assessment rates the confidentiality-only impact at CVSS 3.1 7.5 despite the record's CVSS 4.0 score of 9.3.
OS command injection in Johnson Controls EasyIO FS32 building-automation controller firmware before 3.0b63 allows an attacker who holds high-privilege credentials and can reach the device from an adjacent network segment to execute arbitrary operating-system commands, resulting in full compromise of the controller (CVSS 7.2; the vendor-assigned CVSS 4.0 vector carries an E:P exploit-maturity metric, i.e. proof-of-concept level). No confirmed active exploitation is indicated and no public exploit is identified at time of analysis - the CVE is not in CISA KEV - so the principal real-world gating factors are the PR:H authentication requirement and the AV:A adjacent-network position rather than weaponized, internet-facing exploitation. Defenders should treat the device as high-value OT infrastructure, since a compromised building-automation controller can be pivoted into the wider BAS/BMS network.
Authentication abuse in Johnson Controls EasyIO FS32 building-automation controllers running firmware earlier than 3.0b63 lets an attacker who already holds privileged access on the adjacent network leverage an insecurely initialized default resource to subvert authentication, with assessed consequences spanning integrity and availability of the controller and knock-on effects at system scope. Exploitation is heavily gated: the attacker must sit on the adjacent/local network (AV:A, not internet-reachable), must already be privileged (PR:H), must clear high attack complexity (AC:H) and a specific attack requirement (AT:P), so this is realistically reachable only by someone with an existing foothold on the building-automation network, not by an unauthenticated remote actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is 5.6 (medium).
Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 expose a file/path-handling function to externally controlled input (CWE-73), allowing a high-privileged, authenticated attacker with adjacent-network access to supply crafted file names or paths and reach files outside the intended location, with the potential to read sensitive data and to overwrite or corrupt files that affect device integrity and availability. Exploitation is constrained: it requires a foothold on the OT/building-automation network segment (CVSS AV:A), an elevated privileged session on the device (PR:H), a specific attack prerequisite (AT:P), and a high-complexity sequence (AC:H), yielding a base score of 5.6 under CVSS 4.0 and an assessed CVSS 3.1 vector of AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a genuine but non-urgent issue whose practical risk is materially lower than the path-traversal label alone suggests.
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Hard-coded credentials in Johnson Controls EasyIO FS32 firmware before 3.0b63 allow an attacker with adjacent-network access to use embedded login secrets and cause a high availability impact on the controller; the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only availability affected (C:N/I:N/A:H). This is not remotely internet-exploitable, the vendor notes an additional precondition (CVSS 4.0 AT:P), and no public exploit identified at time of analysis, making it a moderate, context-dependent risk. Johnson Controls lists the fix as EasyIO FS32 firmware 3.0b63 and later, with the advisory at its trust center.