PSIRT Blog

This policy relates to the investigation and disclosure of security vulnerabilities that potentially affect products and services provided by Acuity Brands Lighting, Inc. (ABL)

  • Acuity Brands Message on PHP2Shell Vulnerabilities

    Acuity Brands Message on PHP2Shell Vulnerabilities

    Acuity is aware of the recently disclosed PHP2Shell vulnerabilities that are affecting organizations across multiple industries.

    Read More
  • Q-SYS Peripherals Remote Code Execution due to unauthenticated installation script

    Q-SYS Peripherals Remote Code Execution due to unauthenticated installation script

    Read More

  • View Now
  • Q-SYS Devices Unnecessary Privileges via SUID Wrapper

    Q-SYS Devices Unnecessary Privileges via SUID Wrapper

    Read More
  • Q-SYS Devices Remote Code Execution via unprotected endpoint

    Q-SYS Devices Remote Code Execution via unprotected endpoint

    Read More
  • Q-SYS Processors - Arbitrary File Write through Archive Unpacking

    Q-SYS Processors - Arbitrary File Write through Archive Unpacking

    An authenticated attacker with network access to an affected Q-SYS Core may be able to abuse insufficient validation during the processing of uploaded package content.

    Read More
  • Q-SYS Processors - Unauthenticated Arbitrary File Write through Server-Side Request Forgery

    Q-SYS Processors - Unauthenticated Arbitrary File Write through Server-Side Request Forgery

    An unauthenticated attacker with network access to affected Q-SYS Core may be able to abuse insufficient separation between externally reachable control functionality and privileged internal services.

    Read More
  • Q-SYS Processors - Unauthenticated Log File Write to Arbitrary Location through Path Traversal

    Q-SYS Processors - Unauthenticated Log File Write to Arbitrary Location through Path Traversal

    An unauthenticated attacker with network access to an affected Q-SYS Core may be able to exploit insufficient validation of a user-controlled file reference used by a logging function.

    Read More
  • Q-SYS Processors - Arbitrary File Read through Path Traversal

    Q-SYS Processors - Arbitrary File Read through Path Traversal

    An authenticated attacker with management access and network connectivity to an affected QSYS Core may be able to abuse insufficient validation and authorization of file access requests.

    Read More
  • Q-SYS Processors - Hardcoded Authorization Secrets

    Q-SYS Processors - Hardcoded Authorization Secrets

    Affected Q-SYS Core firmware contains shared authorization material for an optional administrative service (“Secure Maintenance & Support“).

    Read More
  • Q-SYS Statement on CVE‑2026‑31431

    Q-SYS Statement on CVE‑2026‑31431

    A critical vulnerability was discovered in the Linux kernel's algif_aead cryptographic algorithm interface and was assigned CVE identifier CVE‑2026‑31431.

    Read More
  • Q-SYS Core Unauthenticated Privileged Operations

    Q-SYS Core Unauthenticated Privileged Operations

    Q-SYS Core Processors do not require an administrator to set up remote authentication during configuration, allowing a remote, unauthenticated attacker to perform various privileged actions.

    Read More
  • Q-SYS Core Unauthenticated Remote Code Execution

    Q-SYS Core Unauthenticated Remote Code Execution

    Q-SYS Core Processors contain a remote command injection vulnerability. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges.

    Read More
  • Security Vulnerabilities Identified in the Niagara Framework®

    Security Vulnerabilities Identified in the Niagara Framework®

    Security vulnerabilities identified in the Niagara Framework®, fixed and updated software is now available.

    Read More
  • Distech Controls SOLSTYCE DALI Gateway MQX RTOS DHCP and UDP Vulnerabilities

    Distech Controls SOLSTYCE DALI Gateway MQX RTOS DHCP and UDP Vulnerabilities

    Security Vulnerability Announcement on SOLSTYCE DALI Gateways. Fixed software is available.

    Read More
  • Acuity Brands Message on Apache Log4j Vulnerability - CVE-2021-44228

    Acuity Brands Message on Apache Log4j Vulnerability - CVE-2021-44228

    A critical vulnerability in Apache Log4j, a logging subsystem commonly used in Java-based applications and solutions, was identified and assigned CVE identifier CVE-2021-44228.

    Read More
  • Importance of an effective security awareness training program for technology companies

    Importance of an effective security awareness training program for technology companies

    Organizations must protect and secure their data by cultivating a security culture and investing in ongoing cyber and application security awareness training to avoid potential breaches.

    Read More
  • nLight ECLYPSE Default Key Vulnerabiliy

    nLight ECLYPSE Default Key Vulnerabiliy

    nLight ECLYPSE (nECY) system controllers contain a default key vulnerability. The nECY does not force a change to the key upon the initial configuration of an affected device.

    Read More
  • Acuity Brands Message on “Solar Winds Hack”

    Acuity Brands Message on “Solar Winds Hack”

    Acuity Brands is aware of the “SolarWinds Hack” currently reported in the news.

    Read More
  • DGLogik DGLux Server Directory Traversal Vulnerability

    DGLogik DGLux Server Directory Traversal Vulnerability

    The DGLux Server contains a directory traversal vulnerability within the REST API component. The vulnerability impacts DGLux Server builds 1494 and prior.

    Read More
  • PSIRT Overview

    PSIRT Overview

    PSIRT provides a proactive and centralized approach for security concerns arising from the increasingly digital market.

    Read More
  • loading
    Loading More...