The vulnerability stems from insecure default initialization of resources, enabling attackers to bypass authentication and gain unauthorized access to the EasyIO FS32 device. This flaw allows exploitation of default settings without legitimate credentials, compromising the integrity and confidentiality of device operations.

Johnson Controls EasyIO FS32 systems running firmware versions prior to 3.0b63 are affected. The vulnerability is documented for EasyIO FS32 devices before version 3.0b63.

The CVSS score of 5.6 indicates a moderate severity. The EPSS score is not available, so exploitation likelihood cannot be precisely quantified. The vulnerability is not currently listed in the CISA KEV catalog. Attackers may exploit the insecure default initialization via the device’s network interface or local access if the device is not properly isolated; however, the precise attack vector is not explicitly detailed, so it is inferred to involve remote or local access to default-configured resources.