CVE-2026-27874
MediumCVSS 5.0Summary
Johnson Controls EasyIO FS32 before version 3.0b63 contains a Use of Hard-coded Credentials vulnerability that allows exploitation of default or hard-coded credentials.
Risk Assessment
An attacker may gain unauthorized access to the device, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Update EasyIO FS32 to version 3.0b63 or later and change all default credentials to unique and strong ones.
Other vulnerabilities in Johnson Controls EasyIO FS32
See all- CVE-2026-71453Medium
An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.
- CVE-2026-71448Medium
An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.
- CVE-2026-71451Medium
Johnson Controls EasyIO FS32 before version 3.0b63 contains an OS Command Injection vulnerability that allows command injection. An attacker can execute arbitrary commands on the system.
Original NVD description (English source)
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS