The vulnerability allows an attacker to inject and execute arbitrary code on the device, due to insufficient validation of user input in certain parameters. This improper control over code generation can cause unauthorized actions before authentication is established, effectively giving the attacker full control of the device.

Johnson Controls Frick Controls Quantum HD devices running firmware version 10.22 and all earlier releases are impacted. The vendor has classified the 10.22 through 11 platform as End Of Support and recommends moving to the Quantum HD Unity version 12 or later.

The CVSS score of 8.8 denotes a high severity exploitability, while an EPSS score of less than 1% suggests a low probability of current exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a network‑based remote attack, given that the vulnerability can be triggered without any authentication. If exploited, an attacker could gain complete control of the device, compromising its confidentiality, integrity, and availability.