CVE-2026-71453

Received Received - Intake

Path Traversal in Johnson Controls EasyIO FS32

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Johnson Controls

Description

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-71453

Affected Vendors & Products

Vendor	Product	Version / Range
johnson_controls	easyio_fs32	to 3.0b63 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability is an External Control of File Name or Path issue in Johnson Controls EasyIO FS32. It allows an attacker to perform a traversal attack, which could let them access or manipulate files outside the intended directory.

Impact Analysis

An attacker could exploit this to read sensitive files, modify system configurations, or execute unauthorized actions on the affected device. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update Johnson Controls EasyIO FS32 to version 3.0b63 or later to address the vulnerability. Monitor vendor advisories for patches and apply them promptly. Restrict network access to the device if possible.

Hi! I’m here to help you understand CVE-2026-71453. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70