rootpwn

critical · CVSS v3 9.8 · CVSS v4 8.4

CVE-2026-71452

Johnson Controls EasyIO FS32 devices prior to version 3.0b63 are vulnerable to OS command injection, allowing attackers to execute arbitrary

Overview

Johnson Controls EasyIO FS32 devices prior to version 3.0b63 are vulnerable to OS command injection, allowing attackers to execute arbitrary shell commands. The flaw can be triggered via network interfaces exposed by the device. This vulnerability could compromise building automation systems and critical infrastructure.

Description

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63.

Impact

Confidentiality: attackers can read sensitive configuration and logs. Integrity: attackers can modify device settings or firmware. Availability: attackers can crash or lock out the device, disrupting building operations. Impacted parties include facility managers, network administrators, and building automation operators.

Remediation

Apply the latest firmware update (3.0b63 or newer) from Johnson Controls. If immediate update is not possible, restrict network access to the device using firewall rules or VLAN segmentation, and disable unused management interfaces. Monitor logs for suspicious command execution attempts.

Risk context

Severity is critical with CVSS v3 score 9.8. No EPSS data available, but the high severity indicates a high likelihood of exploitation in environments where the device is exposed to untrusted networks.

Affected products

  • Johnson Controls EasyIO FS32

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
8.4
EPSS
—

OS Command Injection Johnson Controls EasyIO FS32 Critical Building Automation Command Injection Firmware Update

← All CVEs

Related CVEs

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-103764

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. This flaw can expose KV cache contents, prompts, and secrets, or corrupt memory leading to code execution. It is critical and requires immediate attention.

View analysis

critical

CVE-2026-103765

Mooncake versions up to 0.3.13.post1 expose a missing authentication flaw in the /metadata HTTP handler, enabling attackers to read, modify, or delete transfer engine metadata. This can lead to data tampering, redirecting KV cache traffic, or exhausting server memory. The vulnerability is critical with a CVSS v3 score of 9.4.

View analysis

critical

CVE-2026-86345

The CVE-2026-86345 flaw in 389-ds-base allows an on-path attacker to inject a crafted LDAP message during a StartTLS upgrade. The injected message can be processed after TLS is established, causing a client to incorrectly interpret a failed bind as successful. This undermines authentication integrity for LDAP clients.

View analysis