IAQS and I6 devices exhibit a Client‑Side Enforcement of Server‑Side Security flaw that enables unauthenticated attackers to manipulate the web front‑end and elevate privileges to administrator level. The weakness, identified as CWE‑603, arises from deficient or missing server‑side validation of actions that the client trusts. This can lead to full control over the affected system without any authentication.

Affected systems are JNC IAQS and I6 devices that utilize the M4 chip. Devices with the M3 chip expose the vulnerability but cannot receive the vendor patch and are recommended for replacement. Determining the chip type is essential before applying corrective action.

The vulnerability carries a CVSS score of 9.3, indicating critical severity, but the EPSS score is less than 1%, suggesting a low likelihood of current exploitation. It is not documented in the CISA KEV catalog. Attackers can exploit this remotely by submitting crafted requests through the web interface, bypassing server‑side checks without needing credentials.