rootpwn

critical · CVSS v3 9.8 · CVSS v4 7.2

CVE-2026-71453

Johnson Controls EasyIO FS32 devices before 3.0b63 are vulnerable to external control of file name or path, enabling directory traversal. At

Overview

Johnson Controls EasyIO FS32 devices before 3.0b63 are vulnerable to external control of file name or path, enabling directory traversal. Attackers can read or write arbitrary files on the device filesystem, potentially exposing sensitive data or disrupting operation.

Description

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.

Impact

The flaw compromises confidentiality, integrity, and availability of data stored on the device. Attackers could exfiltrate configuration files, tamper with firmware, or cause denial of service. Defenders must assess the risk to industrial control systems and critical infrastructure that rely on EasyIO FS32.

Remediation

Apply the vendor‑supplied firmware update to version 3.0b63 or later. If an update is not immediately available, restrict network access to the device, disable remote file upload interfaces, and enforce strict file path validation on any custom scripts interacting with the device.

Risk context

Severity is critical with a CVSS v3 score of 9.8, indicating a high likelihood of exploitation. The absence of EPSS data suggests no recent exploitation reports, but the critical rating warrants prompt action.

Affected products

  • Johnson Controls EasyIO FS32

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
7.2
EPSS
—

directory-traversal file-inclusion industrial-control firmware critical Johnson-Controls EasyIO

← All CVEs

Related CVEs

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-103764

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. This flaw can expose KV cache contents, prompts, and secrets, or corrupt memory leading to code execution. It is critical and requires immediate attention.

View analysis

critical

CVE-2026-103765

Mooncake versions up to 0.3.13.post1 expose a missing authentication flaw in the /metadata HTTP handler, enabling attackers to read, modify, or delete transfer engine metadata. This can lead to data tampering, redirecting KV cache traffic, or exhausting server memory. The vulnerability is critical with a CVSS v3 score of 9.4.

View analysis

critical

CVE-2026-86345

The CVE-2026-86345 flaw in 389-ds-base allows an on-path attacker to inject a crafted LDAP message during a StartTLS upgrade. The injected message can be processed after TLS is established, causing a client to incorrectly interpret a failed bind as successful. This undermines authentication integrity for LDAP clients.

View analysis