The vulnerability is an improper control of code generation (CWE‑94) that allows code injection before authentication. Insufficient validation of certain input parameters can cause the device to execute unintended or malicious code. If exploited, an attacker could gain persistent control over the Frick Controls Quantum HD appliance, impacting confidentiality, integrity, and availability of the device's operations. The flaw exists in the original pre‑support platform and poses a high‑severity threat.

Johnson Controls Frick Controls Quantum HD systems running version 10.22 or earlier are affected. The product is part of the older platform that is no longer supported. Upgrading to the Quantum HD Unity platform, version 12 or later, removes this vulnerability.

The CVSS score of 8.8 indicates high severity, though the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability can be triggered via unauthenticated remote inputs, potentially allowing an attacker to send crafted requests over the network before any authentication is required. The vulnerability is not listed in the CISA KEV catalog, but its pre‑authentication nature and remote code execution potential still demand rapid remediation.