An attacker with network access and valid credentials can exploit unsecured MQTT communications to publish to server topics that control board operations, effectively modifying critical parameters. The flaw is classified as CWE-1366, indicating a lack of proper input validation or security misconfiguration that allows unauthorized configuration changes.

EFACEC QC 60, QC 90, and QC 120 product lines are affected. No specific firmware version numbers are provided, so all current releases of these boards are potentially vulnerable.

The CVSS score of 8.9 indicates high severity, while an EPSS of less than 1% suggests the probability of exploitation is currently low. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely occur over the network, requiring the attacker to possess valid credentials to publish malicious configuration messages to the board's MQTT topics.