The vulnerability identified as a Missing Authentication flaw, designated CWE-306, permits remote attackers to exercise system administrative functions without prior credential verification. Without authentication, an attacker effectively gains the same privileges as a legitimate administrator, opening the door to full control over the device’s configuration, data, and potentially any connected services. Such unauthorized authority can lead to data exfiltration, tampering, or service disruption.

Affected products are JNC’s IAQS and I6 devices. The advisory notes that only devices powered by the M4 chip can receive the vendor-provided patch, whereas devices driven by the M3 chip lack the capability to upgrade and are therefore advised to be replaced. No specific firmware or software version information is supplied; the risk is tied to the chip architecture present on the device.

CVSS scoring indicates a critical severity of 9.3, underscoring the significant impact if exploited, yet the EPSS score shows a probability of exploitation of less than 1 percent, reflecting a low likelihood of active attacks at this moment. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Nonetheless, the vulnerability can be activated remotely, presumably through the device’s network‑connected management interface, and requires no authentication to proceed; patching or replacement is the only effective countermeasure.