Author: Marius Creutznacher
| Risk Category: Critical | Document ID: QSYS-October-19-9008 |
| Document Version: 1.0 | |
| Document Status: Final |
Description:
Affected Q-SYS Core firmware contains shared authorization material for an optional administrative service (“Secure Maintenance & Support“). The service is disabled by default, which limits exposure. If the service is enabled, reachable from an attacker-controlled network, and corresponding authorization material is compromised, an attacker could obtain privileged operating-system access and fully compromise the device.
| CVE ID: | CVSS Vectors: | Score: |
| - | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/ SI:N/SA:N |
9.3 Critical |
Impacted Product Name
Q-SYS Core Processors
Impacted Versions
Q-SYS Designer Version lower than 10.5.0
Impacts on Installed System
Under the required conditions, successful exploitation may provide privileged access and affect confidentiality, integrity, and availability, including information exposure, persistent modification, denial of service, and full system compromise.
How to Diagnose Installed System
Confirm whether the Core runs firmware earlier than 10.5.0 and whether “Secure Maintenance & Support” under “Network > Services” in Core Manager is enabled.
Mitigation
- Install Q-SYS Designer version 10.5.0.
- Keep optional administrative services disabled unless explicitly required. Restrict any required administrative access to trusted hosts and isolate the device from untrusted networks.
Updated Version
Q-SYS Designer 10.5
Issue Fixed Date
29 September 2026
Attribution
National Test Institute for Cybersecurity NTC, https://www.ntc.swiss/
Acuity knows of no exploitation of these vulnerabilities.
LEGAL DISCLAIMER:
THIS CONTENT IS PROVIDED ON AN "AS IS" BASIS FOR INFORMATIONAL PURPOSES ONLY AND IS PROVIDED WITHOUT ANY WARRANTY OF ANY KIND. THE CONTENT IS INTENDED FOR USERS OF ACUITY PRODUCTS WHO POSSESS THE PROFESSIONAL SKILLS AND JUDGMENT NECESSARY TO INTERPRET THE INFORMATION AND DETERMINE THE APPROPRIATE STEPS TO TAKE. USE OF THE INFORMATION IS AT THE USER'S OWN RISK. THE AUTHOR RESERVES THE RIGHT TO UPDATE OR DELETE THIS CONTENT AT ANY TIME.
