Johnson Controls Illustra Standard – L4L China on Windows contains an improper input validation flaw that enables OS command injection, classified as CWE-20. An attacker who supplies crafted input can execute arbitrary commands, potentially compromising system integrity and confidentiality. The CVSS score of 5.1 indicates a moderate severity level for this vulnerability.

The flaw affects Johnson Controls Illustra Standard – L4L China on Windows, specifically all versions prior to 6.0.0.66394. Any installation of the product on Windows that has not been updated to this baseline version retains the vulnerability.

There is no publicly available EPSS score and the vulnerability is not listed in CISA KEV, so the current exploitation probability is uncertain. The CVSS rating reflects a medium risk, and exploiting the flaw would require an attacker to inject malicious input into the application; successful exploitation would allow the attacker to run arbitrary OS commands and potentially gain elevated privileges or disrupt operations.