rootpwn

critical · CVSS v3 7.5 · CVSS v4 10

CVE-2026-71449

Johnson Controls EasyIO FS32 devices before 3.0b63 contain a hard‑coded cryptographic key that can be exploited to retrieve embedded sensiti

Overview

Johnson Controls EasyIO FS32 devices before 3.0b63 contain a hard‑coded cryptographic key that can be exploited to retrieve embedded sensitive data. The flaw allows attackers to read protected information from the device. It is a critical vulnerability with a CVSS v4 score of 10.0.

Description

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.

Impact

Confidentiality is compromised as attackers can read sensitive data stored on the device. Availability may be impacted if the device is misused to exfiltrate data. Integrity is at risk if attackers modify data. Defenders and device operators are directly affected.

Remediation

Upgrade EasyIO FS32 to version 3.0b63 or later where the hard‑coded key issue is fixed. If upgrade is not possible, disable cryptographic functions that rely on the hard‑coded key or replace the key with a secure, device‑specific key. Apply any vendor security patches and monitor device logs for anomalous read attempts.

Risk context

The vulnerability is rated critical with a CVSS v4 score of 10.0, indicating a high likelihood of exploitation and severe impact. Immediate attention is warranted to mitigate potential data exposure.

Affected products

  • Johnson Controls EasyIO FS32
  • EasyIO FS32
  • Johnson Controls FS32

Scores

Severity
critical
CVSS v2
5
CVSS v3
7.5
CVSS v4
10
EPSS
—

hardcoded-key JohnsonControls EasyIO critical data-exfiltration patch vulnerability

← All CVEs

Related CVEs

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-103764

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. This flaw can expose KV cache contents, prompts, and secrets, or corrupt memory leading to code execution. It is critical and requires immediate attention.

View analysis

critical

CVE-2026-103765

Mooncake versions up to 0.3.13.post1 expose a missing authentication flaw in the /metadata HTTP handler, enabling attackers to read, modify, or delete transfer engine metadata. This can lead to data tampering, redirecting KV cache traffic, or exhausting server memory. The vulnerability is critical with a CVSS v3 score of 9.4.

View analysis

critical

CVE-2026-86345

The CVE-2026-86345 flaw in 389-ds-base allows an on-path attacker to inject a crafted LDAP message during a StartTLS upgrade. The injected message can be processed after TLS is established, causing a client to incorrectly interpret a failed bind as successful. This undermines authentication integrity for LDAP clients.

View analysis