A local file inclusion weakness in Johnson Controls Frick Controls Quantum HD allows an unauthenticated attacker to read or execute files on the device. The flaw is a classic path traversal (CWE‑22) and generic local file inclusion (CWE‑23) that can be leveraged to run arbitrary code and exfiltrate sensitive information, ultimately leading to complete compromise of the affected system's confidentiality, integrity, and availability.

Devices running Johnson Controls Frick Controls Quantum HD firmware version 10.22 and earlier are vulnerable. The issue is present on the older Quantum HD platform; moving to the newer Quantum HD Unity platform version 12 or later eliminates the vulnerability.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1 % shows a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely via network interfaces exposed by the device and does not require authentication. The combination of critical impact and low exploitation likelihood still warrants prompt action.