File and Path Handling

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2020-9050Johnson Controls · CVSS 7.5 · 3.8% likely

   CWE-22

2. Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File InclusionCVE-2026-21659Johnson Controls · CVSS 8.7 · 1.0% likely

   CWE-23

3. FMS Employee Allows Upload of Unrestricted FilesCVE-2026-21662Johnson Controls · CVSS 4.8 · 0.5% likely

   CWE-434

4. Airwall - Arbitrary file readCVE-2026-34492Johnson Controls · CVSS 7 · 0.4% likely

   CWE-73

5. - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.CVE-2026-71453Johnson Controls · CVSS 5.6 · 0.1% likely

   CWE-73

6. AC2000 Uncontrolled Search Path ElementCVE-2026-21661Johnson Controls · CVSS 8.4 · 0.1% likelycovered by CyberSIXT

   CWE-427

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.