An internal attacker can cause a denial of service by opening two simultaneous Telnet sessions on the device. The flaw leads to a resource exhaustion condition that renders the service unresponsive; it is identified as CWE‑400.

The affected products are EFACEC QC 60, QC 90 and QC 120. No specific firmware or software version information is provided.

The vulnerability has a high CVSS score of 9.2, indicating severe impact. The EPSS score is below 1 percent, suggesting low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation requires access to the device’s internal network and the ability to open multiple Telnet connections, so an attacker must be locally connected or within a trusted segment.