External risk intelligence

Johnson Controls EasyIO FS32 Hard-coded Key Vulnerability Allows Sensitive Data Retrieval.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71449

The Johnson Controls EasyIO FS32 is a building automation controller designed to manage facility infrastructure. Such devices are frequently deployed as network-accessible gateways or management interfaces to enable remote monitoring and control of building systems, making them commonly reachable in operational technology network deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Johnson Controls EasyIO FS32 devices that could allow unauthorized retrieval of sensitive embedded data. This type of issue could potentially expose critical information within these building automation systems. The main concern at this time is confirming if these specific devices are in use and, if so, their potential exposure.

Sensitive data may be exposed.
Affects building automation systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially access sensitive information stored within the Johnson Controls EasyIO FS32 system due to a hard-coded cryptographic key. This vulnerability is present in systems prior to version 3.0b63 and can be reached without any special privileges or user interaction, leading to the potential retrieval of embedded sensitive data.

No authentication or privileges needed.
Access to the vulnerable component.
Exposure of embedded sensitive data.

Live Threat

Current exploitation, exposure, and threat context

A hard-coded cryptographic key in the Johnson Controls EasyIO FS32 could allow an attacker to retrieve embedded sensitive data. This vulnerability is present when the system is exposed to the network.

Embedded sensitive data at risk.
Retrieval via network access.
Potential unauthorized access to system information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in Johnson Controls EasyIO FS32 involves a hard-coded cryptographic key, potentially allowing sensitive data retrieval. Ownership likely falls to the facilities or building automation systems team responsible for managing EasyIO devices, with coordination from the IT or security team. The first practical step is to identify all EasyIO FS32 instances, determine their network exposure and criticality, and confirm the responsible asset owner before planning remediation.

Facilities and IT teams own remediation efforts.
Verify device network exposure and criticality.
Plan and execute vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Johnson Controls EasyIO FS32?

The EasyIO FS32 is a building automation controller. It serves as a specialized device used to monitor and manage facility infrastructure, such as HVAC or lighting systems. These controllers often function as gateways, linking physical equipment to a digital network to enable centralized oversight of building operations.

What does CWE-321 mean for CVE-2026-71449?

This CVE involves a Use of a Hard-coded Cryptographic Key, classified as CWE-321. This means the software uses a fixed, unchanging key to encrypt or secure sensitive data. Because this key is built directly into the code and cannot be easily changed by users, an unauthorized party who obtains the key can potentially bypass security protections to decrypt or access information that was meant to remain private.

How is the EasyIO FS32 vulnerability triggered?

The vulnerability is triggered by accessing the device over a network. An attacker does not need special privileges, user interaction, or authentication to exploit this weakness. It is important to note that the issue resides in the software itself; it is not triggered by specific user configurations or settings, but rather exists inherently in affected versions prior to 3.0b63.

Do I need to worry about CVE-2026-71449?

If you manage these devices, yes. According to Halo Surface Signal, the EasyIO FS32 is often deployed as a network-accessible gateway to manage facility infrastructure. Because these devices are frequently reachable within operational technology networks, they may be exposed to unauthorized access if they are connected to broader or internet-facing networks.

What should I do if I use EasyIO FS32?

Begin by auditing your environment to identify all instances of the EasyIO FS32 controller. Once located, verify the version running on each device and determine if they are accessible via your network. Coordinate with your facilities and IT teams to assess the criticality of these assets and prepare for vendor-provided updates to remediate the hard-coded key issue.

References

www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.