CVE-2026-71451
MediumCVSS 5.6Summary
Johnson Controls EasyIO FS32 before version 3.0b63 contains an OS Command Injection vulnerability that allows command injection. An attacker can execute arbitrary commands on the system.
Risk Assessment
An attacker may gain control over the device, execute unauthorized commands, potentially leading to system integrity compromise and service availability issues.
Recommendation
Update EasyIO FS32 to version 3.0b63 or later to remediate the vulnerability.
Other vulnerabilities in Johnson Controls EasyIO FS32
See all- CVE-2026-71453Medium
An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.
- CVE-2026-71448Medium
An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.
- CVE-2026-27874Medium
Johnson Controls EasyIO FS32 before version 3.0b63 contains a Use of Hard-coded Credentials vulnerability that allows exploitation of default or hard-coded credentials.
Original NVD description (English source)
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS