Medium severity · published Oct 1, 2026
CVE-2026-27874
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials
5.0
CVSS
0.1%
EPSS
No
On KEV
Description
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials.
This issue affects EasyIO FS32: before 3.0b63.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
EasyIO FS32 · Johnson Controls
before 3.0b63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27874
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27874
www.johnsoncontrols.com
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
More from EasyIO FS32
9.3
CVE-2026-71449
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data
7.2
CVE-2026-34493
- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations
7.2
CVE-2026-71452
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection
5.6
CVE-2026-71448
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse
5.6
CVE-2026-71453
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack