CVE-2026-71448
MediumCVSS 5.6Summary
An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.
Risk Assessment
The risk includes unauthorized access to the system, potentially leading to confidentiality, integrity, and availability breaches, as well as device takeover.
Recommendation
It is recommended to update EasyIO FS32 to version 3.0b63 or later and change all default passwords and configurations to secure values.
Other vulnerabilities in Johnson Controls EasyIO FS32
See all- CVE-2026-71453Medium
An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.
- CVE-2026-71451Medium
Johnson Controls EasyIO FS32 before version 3.0b63 contains an OS Command Injection vulnerability that allows command injection. An attacker can execute arbitrary commands on the system.
- CVE-2026-27874Medium
Johnson Controls EasyIO FS32 before version 3.0b63 contains a Use of Hard-coded Credentials vulnerability that allows exploitation of default or hard-coded credentials.
Original NVD description (English source)
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS