Description
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.

This issue affects EasyIO FS32: before 3.0b63.
Published: 2026-10-01
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Directory Traversal
Action: Assess Impact
AI Analysis

Impact

The vulnerability allows an attacker to specify arbitrary file names or paths, causing the system to access files outside of the intended directory. This can lead to disclosure of sensitive configuration data or logs, and potentially files containing credentials. The weakness is a classic path traversal flaw.

Affected Systems

Johnson Controls EasyIO FS32 firmware versions prior to 3.0b63 are affected. Only these older releases contain the vulnerable file handling logic.

Risk and Exploitability

The CVSS score for this issue is 5.6, indicating a moderate severity level. EPSS data is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, through exposed configuration interfaces that accept file name or path parameters.

Generated by OpenCVE AI on October 1, 2026 at 22:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the EasyIO FS32 firmware to version 3.0b63 or later.
  • Restrict network access to the device’s management and configuration interfaces using firewalls or access control lists.
  • Sanitize and validate all user-supplied file path inputs on the device before processing them.

Generated by OpenCVE AI on October 1, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Title External Control of File Name or Path Leading to Directory Traversal in Johnson Controls EasyIO FS32

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.
First Time appeared Johnson Controls
Johnson Controls easyio Fs32
Weaknesses CWE-73
CPEs cpe:2.3:a:johnson_controls:easyio_fs32:*:*:*:*:*:*:*:*
Vendors & Products Johnson Controls
Johnson Controls easyio Fs32
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Johnson Controls Easyio Fs32
cve-icon MITRE

Status: PUBLISHED

Assigner: jci

Published:

Updated: 2026-10-02T19:26:29.901Z

Reserved: 2026-08-06T19:11:09.315Z

Link: CVE-2026-71453

cve-icon Vulnrichment

Updated: 2026-10-02T19:26:16.930Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T22:17:05.310

Modified: 2026-10-02T20:17:04.207

Link: CVE-2026-71453

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:57:45Z

Weaknesses
  • CWE-73

    External Control of File Name or Path