rootpwn

critical · CVSS v3 9.8 · CVSS v4 7.2

CVE-2026-71448

Johnson Controls EasyIO FS32 devices prior to version 3.0b63 are vulnerable to insecure default initialization of resources, enabling attack

Overview

Johnson Controls EasyIO FS32 devices prior to version 3.0b63 are vulnerable to insecure default initialization of resources, enabling attackers to abuse authentication mechanisms. This flaw can allow unauthorized access to the device's control interface. The vulnerability is rated critical with a CVSS v3 score of 9.8.

Description

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.

Impact

The vulnerability compromises confidentiality, integrity, and availability of the device's control functions. Attackers can gain unauthorized access, potentially manipulating HVAC or building automation settings. Defenders should treat exposed devices as compromised until patched. The risk is high for facilities relying on these controllers.

Remediation

Update the device firmware to version 3.0b63 or later, which removes the insecure default initialization. If an update is not immediately possible, disable unused authentication methods, enforce strong passwords, and restrict network access to the device via firewalls or VLAN segmentation. Monitor device logs for anomalous authentication attempts.

Risk context

Critical severity and a CVSS v3 score of 9.8 indicate a high risk. No EPSS data is available, but the lack of a patch for older firmware increases urgency. Defenders should prioritize remediation.

Affected products

  • Johnson Controls EasyIO FS32

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
7.2
EPSS
—

authentication firmware critical Johnson Controls EasyIO resource-initialization device-security

← All CVEs

Related CVEs

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-103764

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. This flaw can expose KV cache contents, prompts, and secrets, or corrupt memory leading to code execution. It is critical and requires immediate attention.

View analysis

critical

CVE-2026-103765

Mooncake versions up to 0.3.13.post1 expose a missing authentication flaw in the /metadata HTTP handler, enabling attackers to read, modify, or delete transfer engine metadata. This can lead to data tampering, redirecting KV cache traffic, or exhausting server memory. The vulnerability is critical with a CVSS v3 score of 9.4.

View analysis

critical

CVE-2026-86345

The CVE-2026-86345 flaw in 389-ds-base allows an on-path attacker to inject a crafted LDAP message during a StartTLS upgrade. The injected message can be processed after TLS is established, causing a client to incorrectly interpret a failed bind as successful. This undermines authentication integrity for LDAP clients.

View analysis