Johnson Controls EasyIO FS32 devices before version 3.0b63 store default or hard‑coded credentials, allowing an attacker to authenticate without valid user input. This weakness is a classic case of plain‑text credential storage and can lead to full device compromise, giving the attacker control over device settings and potential network communication.

The affected platform is Johnson Controls EasyIO FS32 devices running firmware versions older than 3.0b63. Hardware or virtual instances configured with the original default credentials, or those that have retained hard‑coded passwords, are vulnerable.

The CVSS score of 5 indicates a medium severity, but the absence of an EPSS rating means there is no current exploitation probability data. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is likely remote over the network or local if the device is physically accessible. Exploitation can occur by transporting the hard‑coded username/password or by simply logging in with default credentials, granting full administrative control.