Contemporary Controls BASC 20T allows an attacker who can observe traffic to forge packets that the device will treat as legitimate requests. Because the system relies on untrusted network input for security decisions, these forged requests can lead to unauthorized commands or configuration changes on the controller, potentially compromising the confidentiality, integrity, and availability of the industrial control system.

The vulnerability applies to the Contemporary Controls BASC 20T (BASControl20) controller used in industrial automation. The product is marked as obsolete and the advisory does not list specific firmware or hardware revisions; users must identify if their installations include this model and confirm the exact revision in use.

With a CVSS base score of 9.3 the issue is classified as critical. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires remote network access to capture legitimate traffic and then resend crafted packets to the controller, making it a remote attack that can have severe operational impacts.