Johnson Controls EasyIO FS32 firmware before version 3.0b63 contains a hard‑coded cryptographic key that allows an attacker to decrypt and retrieve sensitive data embedded in the device. The flaw enables direct access to confidential information without the need for additional credentials, resulting in a complete loss of data confidentiality.

Only Johnson Controls EasyIO FS32 devices with firmware earlier than 3.0b63 are impacted. The device uses a hard‑coded key for data encryption, and no other products or firmware versions are reported to have this weakness.

With a CVSS score of 9.3 the vulnerability is classified as critical. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The flaw requires the ability to read data protected by the hard‑coded key; therefore the likely attack vector is either local access to the device or exploitation through exposed interfaces that expose the encrypted data.