Johnson Controls EasyIO FS32 suffers from an OS command injection vulnerability that permits the execution of arbitrary operating‑system commands. The flaw allows an attacker to inject and execute commands through unsanitized input, potentially compromising the device’s integrity, confidentiality, and availability. This weakness is classified as CWE‑78 and could be leveraged to gain full control of the affected system.

The vulnerability applies to Johnson Controls EasyIO FS32 firmware versions prior to 3.0b63. Devices running these legacy firmware releases are at risk, while those updated to version 3.0b63 or later are considered mitigated.

The CVSS score of 7.2 signals a high severity level for Johnson Controls EasyIO FS32. While the EPSS score is not available, the lack of KEV inclusion suggests that widespread exploitation has not yet been reported. The likely attack vector is via externally accessible input, such as web interfaces or remote management protocols, and requires that attacker‑controlled data be passed to a vulnerable command execution context. Given the potential for remote code execution, the risk to affected Johnson Controls EasyIO FS32 devices is significant and warrants prompt mitigation.