CVE-2026-71452
HighCVSS 7.2Summary
An OS Command Injection vulnerability exists in Johnson Controls EasyIO FS32. This issue affects EasyIO FS32 versions before 3.0b63.
Risk Assessment
An attacker could inject and execute arbitrary operating system commands on the device, potentially leading to full compromise of the controller and the network it operates in.
Recommendation
Upgrade EasyIO FS32 to version 3.0b63 or later. Until patched, restrict network access to the device interface.
Other vulnerabilities in EasyIO FS32
See all- CVE-2026-34493High
An On-Chip Debug Interface vulnerability exists in Johnson Controls EasyIO FS32 that allows collecting data from common resource locations. This issue affects EasyIO FS32 versions before 3.3b63.
- CVE-2026-71449Critical
A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.
Original NVD description (English source)
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS