The vulnerability arises from the inclusion of functionality originating from an untrusted control sphere within Johnson Controls EasyIO Neo IOManager and Tools Installer. This flaw allows an attacker to trigger a malicious software update, effectively installing arbitrary code with elevated firmware privileges. The outcome can compromise confidentiality, integrity, and availability of the device, as an attacker could execute arbitrary instructions or alter device behavior.

Johnson Controls EasyIO Neo IOManager and Tools Installer, version 1.1.0.0, is affected by this issue. All installations of the product running this version should be considered vulnerable until patched.

The CVSS score of 7.3 indicates a high level of risk. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, but the potential for remote code execution remains significant. An attacker would likely need to exploit the update mechanism, which may be reachable over the local network or through privileged user access, to deliver the malicious payload.