The vulnerability allows an attacker who can observe network traffic to detect credentials transmitted in clear text. This disclosure exposes user authentication information, enabling credential compromise and potential unauthorized access. The weakness aligns with CWE‑319, a clear‑text transmission issue that directly attacks confidentiality.

The affected product is the EFACEC QC series (models 60, 90, and 120). No specific firmware or software version numbers are provided in the data.

The CVSS score of 8.7 indicates a high severity due to the loss of confidentiality, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker with direct network connectivity to the device, typically via a man‑in‑the‑middle position or insider access, to capture the clear‑text credentials as they are exchanged. Proper network segmentation and the use of encrypted channels would mitigate the exploitation vector.