JohnsonControls AC2000 devices running on Windows are affected by an Uncontrolled Search Path Element flaw that permits an attacker to manipulate the directories used when the system resolves configuration files. By altering these search paths, an adversary can cause the device to load malicious components or execute unintended code, potentially leading to unauthorized privilege escalation or remote code execution.

The vulnerability affects JohnsonControls AC2000 devices running version 10.6 prior to release 10, version 11.0 prior to release 9, and version 12 prior to release 3. All affected systems operate on Windows platforms.

The CVSS score of 8.4 indicates high severity, the EPSS score is less than 1%, and it is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local or remote via manipulation of the system’s executable search path, which could allow privilege escalation or remote code execution if an attacker gains sufficient access to the configuration files or can inject malicious code into the search path. Given the high CVSS score and the low EPSS likelihood, the risk remains significant but no confirmed exploitation has been reported.