Johnson Controls EasyIO FS32 contains a weakness in its On-Chip Debug Interface that allows an attacker to collect data from common resource locations. This flaw can be exploited to read sensitive data stored in the device’s internal memory or configuration files, resulting in a compromise of confidentiality. The vulnerability is classified as CWE-1191 and poses a moderate to high risk as it enables data exfiltration without requiring additional privileges. The only stated impact is the potential leakage of stored data; other consequences such as integrity or availability are not mentioned explicitly in the advisory.

The flaw affects all EasyIO FS32 models running firmware versions prior to 3.3b63. Users with deployments of earlier firmware should verify their version and plan an upgrade to the patched release when available. No other vendors or products are listed as affected.

The CVSS score of 7.2 indicates a medium to high severity. The EPSS score is not provided, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves access to the On-Chip Debug Interface, which could be local or remote if the interface is exposed over a network connection. No specific exploitation conditions are detailed beyond the requirement to use the debug interface to read data.