Author: Marius Creutznacher
| Risk Category: High | Document ID: QSYS-October-19-9007 |
| Document Version: 1.0 | |
| Document Status: Final |
Description:
An authenticated attacker with management access and network connectivity to an affected QSYS Core may be able to abuse insufficient validation and authorization of file access requests. The affected interface may permit access beyond the intended application data scope and expose files or system information stored on the device. Exploitation requires valid management access.
| CVE ID: | CVSS Vectors: | Score: |
| CVE-2026-88460 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/ SI:N/SA:N |
7.1 High |
Impacted Product Name
Q-SYS Core Processors
Impacted Versions
Q-SYS Designer Version lower than 10.5.0
Impacts on Installed System
Successful exploitation may disclose sensitive files or system information from the affected Core. No direct integrity or availability impact was identified.
How to Diagnose Installed System
Confirm whether the Core runs firmware earlier than 10.5.0, whether Core Manager Access Control is enabled, and whether management access is restricted to trusted users and networks.
Mitigation
- Install Q-SYS Designer version 10.5.0.
- Keep Core Manager Access Control enabled, restrict management access to trusted networks, rotate potentially exposed credentials, and prevent untrusted management access until the fixed release is installed.
Updated Version
Q-SYS Designer 10.5
Issue Fixed Date
29 September 2026
Attribution
National Test Institute for Cybersecurity NTC, https://www.ntc.swiss/
Acuity knows of no exploitation of these vulnerabilities.
LEGAL DISCLAIMER:
THIS CONTENT IS PROVIDED ON AN "AS IS" BASIS FOR INFORMATIONAL PURPOSES ONLY AND IS PROVIDED WITHOUT ANY WARRANTY OF ANY KIND. THE CONTENT IS INTENDED FOR USERS OF ACUITY PRODUCTS WHO POSSESS THE PROFESSIONAL SKILLS AND JUDGMENT NECESSARY TO INTERPRET THE INFORMATION AND DETERMINE THE APPROPRIATE STEPS TO TAKE. USE OF THE INFORMATION IS AT THE USER'S OWN RISK. THE AUTHOR RESERVES THE RIGHT TO UPDATE OR DELETE THIS CONTENT AT ANY TIME.
