CVE-2026-71449

Received Received - Intake

Hard-coded Cryptographic Key in Johnson Controls EasyIO FS32

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Johnson Controls

Description

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-71449

Affected Vendors & Products

Vendor	Product	Version / Range
johnson_controls	easyio_fs32	to 3.0b63 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of a hard-coded cryptographic key in Johnson Controls EasyIO FS32 software versions before 3.0b63. Attackers can exploit this to retrieve embedded sensitive data from the system.

Detection Guidance

This vulnerability involves hard-coded cryptographic keys in Johnson Controls EasyIO FS32 firmware versions before 3.0b63. Detection requires checking the firmware version and inspecting for embedded sensitive data. No specific commands are provided in the available context.

Impact Analysis

An attacker could gain access to sensitive information stored or transmitted by the EasyIO FS32 device. This may lead to data breaches, unauthorized access to system functions, or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or exposure. Organizations may face legal penalties, fines, or reputational damage for failing to protect sensitive data.

Mitigation Strategies

Update EasyIO FS32 to version 3.0b63 or later to address the hard-coded cryptographic key vulnerability. Remove any embedded sensitive data if exposed and review access controls for affected systems.

Hi! I’m here to help you understand CVE-2026-71449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70