The vulnerability arises from hardcoded email credentials being stored in plaintext within the firmware of Frick Controls Quantum HD. This flaw, classified as plaintext storage of a password, allows an attacker to discover valid credentials that can be used to log in, access sensitive information, and potentially compromise the system. The damage potential includes unauthorized access, data exposure, and loss of system integrity derived strictly from the provided description.

Frick Controls Quantum HD models running firmware version 10.22 or earlier are affected. The vendor product is Johnson Controls:Frick Controls Quantum HD. No further sub‑versions are listed; all releases at or below 10.22 should be considered vulnerable.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the attacker to obtain or analyze the firmware, implying local or supply‑chain access. With the exposed credentials, an attacker could authenticate to the device and perform unauthorized actions if no additional safeguards are in place.