Improper input validation in certain parameters permits code injection before authentication, allowing an attacker to execute arbitrary code on the device. The vulnerability falls under CWE-94 and can compromise confidentiality, integrity, and availability by enabling malicious commands to run on the control system.

Johnson Controls Frick Controls Quantum HD devices running version 10.22 or earlier, all of which are supported on the older platform and must be upgraded to the Quantum HD Unity 12 platform or later.

The vulnerability has a severity score of 8.8, placing it in the high severity range. The low exploitation probability indicates that it is unlikely to be widely used, yet it is not yet listed in the CISA KEV catalog. Because code execution can occur before authentication, any device still running the older, unsupported firmware is at significant risk, especially if exposed to external networks.