The vulnerability arises from an incorrect sudoers configuration that fails to enforce permissions for the user XXX, allowing that user to execute commands as the superuser without restriction. This flaw enables an attacker with local access to elevate privileges, obtain full system control, and compromise confidentiality, integrity, and availability of the affected device. The weakness maps to CWE-269, reflecting a lack of authorization controls.

EFACEC offers QC series configurations, including QC 60, QC 90, and QC 120 models, that are affected by the described sudoers misconfiguration. No specific firmware or software version details are disclosed; the flaw affects all current releases under the mentioned product line.

The CVSS score of 8.6 indicates a high severity exploit. EPSS is below 1 %, suggesting a low incidence of exploitation but not negligible. The vulnerability is not listed in the CISA KEV catalog, implying no publicly available exploit code has yet been confirmed. Likely attack requires local access and knowledge of the sudoers file. An attacker who can log in as user XXX could achieve full privilege escalation by running arbitrary commands as root.