This vulnerability is classified as CWE-798, indicating the use of hard-coded credentials in Johnson Controls EasyIO FG versions before 2.0b52. Hard-coded credentials can be exploited by attackers to perform password spraying attacks, potentially leading to unauthorized access. The CVSS 4.0 base score is 5.6 (medium), reflecting local attack vector, high attack complexity, partial privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

The use of hard-coded credentials can allow attackers with local access and partial privileges to attempt password spraying attacks, potentially compromising system confidentiality, integrity, and availability. However, no known active exploits have been reported in the wild for this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected systems and monitor for unauthorized access attempts related to credential misuse.