Loading vulnerability…
Unauthenticated RCE via LFI/Path Traversal in Johnson Controls Frick Controls Quantum HD (<= 10.22)
Information not available in the provided content to describe the vulnerable function/endpoint or the precise LFI/path traversal mechanics beyond the high-level characterization (LFI/relative path traversal) and affected product/version.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Information not available in the provided content beyond: unauthenticated remote code execution and information disclosure, potentially leading to full system compromise of the affected device.
If you can’t patch tonight, do this now.
Information not available in the provided content beyond general CISA ICS guidance: minimize internet exposure of control system devices, place control system networks behind firewalls and isolate from business networks, and use VPNs for remote access (kept updated).
Patch, then assume compromise.
Information not available in the provided content (no fixed version or vendor patch details were included).
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.