A missing authentication check in the critical command interface of Pharos Controls Mosaic Show Controller firmware 2.15.3 permits an attacker to execute arbitrary commands with root privileges. This flaw originates from CWE‑306, enabling a compromise of confidentiality, integrity, and availability by allowing an unauthenticated attacker to gain full system control.

Pharos Controls Mosaic Show Controller, firmware version 2.15.3.

The CVSS score of 9.3 indicates a high severity vulnerability. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network connection that exploits the unauthenticated command interface; the attacker need not authenticate, allowing direct execution of arbitrary commands.