The vulnerability stems from missing authentication on a critical function of the PLC, allowing a remote actor to influence the device’s internal logic without proper safeguards. Because the flaw is a lack of authentication (CWE-306), an attacker could trigger or manipulate these functions, potentially altering device behavior and undermining safety or security operations. The impact is primarily on integrity and availability of the system’s normal functioning.

Welker’s OdorEyes EcoSystem Pulse Bypass System with XL4 Controller is affected. Version details are not provided in the advisory, so all deployed units of this device are presumed vulnerable unless verified as patched.

The advisory lists a CVSS base score of 8.2, indicating high severity, but the EPSS is reported as less than 1 %, signifying a low probability of exploitation in the wild. The vulnerability is not currently in CISA’s KEV catalog. The likely attack vector is remote, inferred from the statement that the PLC can be “remotely influenced.” Exploitation would require network connectivity to the PLC and an understanding of its exposed interfaces, but no specific authentication or privilege prerequisites are disclosed in the description.