The vulnerability allows an attacker to send specially crafted packets to the Labkotec LID-3300IP without any authentication, enabling the alteration of device parameters and execution of operational commands. This results in remote unauthorized control over the device’s configuration and command interface, potentially disrupting operations, bypassing security controls, and compromising confidentiality, integrity, and availability. The weakness is missing authentication for a critical function (CWE-306).

The affected devices are the Labkotec LID-3300IP and the LID-3300IP Type 2 models running firmware versions prior to V2.40. Devices that are not connected to an Ethernet network are not susceptible. Ice detectors operating exclusively on secure internal networks that adhere to modern security standards, where only authorized devices and users have access, are protected against external threats.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the Ethernet interface, and an attacker who can reach the device across the network can send the crafted packets to trigger the unauthenticated command execution.