Johnson Controls EasyIO FS32: Use of hard-coded cryptographic key
Summary
Johnson Controls EasyIO FS32 devices before firmware 3.0b63 contain a hard-coded cryptographic key (CWE-321). According to the CVE record, an attacker can retrieve embedded sensitive data. The CVSS vector is network-based and requires no privileges or user interaction, so devices that are reachable from untrusted networks are at the highest risk.
Affected
- EasyIO FS32: all versions before 3.0b63
Fixed in
- Firmware 3.0b63 or later
Workaround
- No vendor-documented workaround found.
- Until patched: isolate the device from the internet and general office networks, restrict access to its management interface, and monitor its traffic. These are general measures, not vendor guidance.
Exploitation
- No exploitation known. CISA SSVC lists exploitation as none and automatable as yes.
- Not in CISA KEV. EPSS below 1%.
- No public proof of concept found.
Our recommendation
- Update FS32 devices to firmware 3.0b63 or later as soon as practical.
- If patching is not possible immediately, isolate the device and restrict access to its management interface.
- Check your asset inventory and external scans for FS32 units.
- After patching, rotate credentials and keys that the device or connected services used, because the embedded key may be known to anyone who obtained the firmware.
- Verify details against the Johnson Controls advisory, which could not be retrieved for this entry.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Johnson Controls Security Advisories www.johnsoncontrols.com
- VulDB: CVE-2026-71449 vuldb.com
- OpenCVE: CVE-2026-71449 app.opencve.io
- Strix: CVE-2026-71449 www.strix.ai
- ThreatInt: CVE-2026-71449 cve.threatint.com
- Threat Radar: CVE-2026-71449 radar.offseq.com
- TheHackerWire: CVE-2026-71449 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:37.
Original description (NVD)
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.