An OS Command Injection flaw in Johnson Controls EasyIO FS32 allows an attacker to inject arbitrary system commands through vulnerable input handling. This vulnerability is classified under CWE-78 and can give the attacker the ability to execute commands on the underlying operating system, potentially leading to full system compromise.

Affected systems are Johnson Controls EasyIO FS32 devices running firmware versions earlier than 3.0b63. Any installation of EasyIO FS32 prior to this release is vulnerable.

The CVSS score of 5.6 indicates moderate severity. The exploit likelihood is currently unknown as an EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. However, because the flaw permits command execution, a malicious actor with network access to the device could exploit it by supplying crafted input, which may not require elevated privileges if the device exposes vulnerable interfaces.