JohnsonControls AC2000 on Windows contains an Uncontrolled Search Path Element vulnerability that allows an attacker to manipulate the configuration file search paths, potentially causing the system to load malicious components or execute arbitrary code. This flaw is classified as CWE-427 and represents a serious security risk.

The vulnerability affects JohnsonControls AC2000 devices running version 10.6 prior to release 10, version 11.0 prior to release 9, and version 12 prior to release 3. All affected systems operate on Windows platforms.

The CVSS score of 8.4 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local or remote via manipulation of the system’s executable search path, which could allow privilege escalation or remote code execution if an attacker gains sufficient access to the configuration files or can inject malicious code into the search path. Given the high CVSS score and the absence of active exploitation data, the risk remains significant but no confirmed exploitation has been reported.