Author: Marius Creutznacher
| Risk Category: Critical | Document ID: QSYS-October-19-9011 |
| Document Version: 1.0 | |
| Document Status: Final |
Description:
All impacted Q-SYS products are vulnerable to a remote code execution issue. An unauthenticated, remote attacker with the ability to connect to a web accessible API endpoint could gain the ability to execute arbitrary code with elevated privileges. A successful attack could impact the confidentiality, integrity or availability of the device.
| CVE ID: | CVSS Vectors: | Score: |
| CVE still pending | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/ SI:N/SA:N |
9.3 Critical |
Impacted Product Name:
Affected Product (Categories):
- Core Processors
- Core Processors in Peripheral Mode I/O Mode
- NC Series
- NV Series
- RMP-100
- QIO-VEN4
- TSC-Series (incl. PS-TSCG3)
- I/O-USB-Bridge
- CX-Q
- CXD-Q
- DPA-Q
- MPA-Q
- SPA-Q
- DCIO/-H
- QIO-ML24i
- QIO-24f
- QIO-L24o
Non-Affected Product (Categories):
- QIO-ML4i
- QIO-ML2x2
- QIO-L4O
- QIO-AES-8x8
- QIO-TEL2
- QIO-FLEX4A
- QIO-GP8x8
- QIO-S4
- QIO-IR1x4
- NM-T1
- NL-Series
Impacted Versions
Q-SYS Designer Version lower than 10.4.
RoomSuite Modular System Firmware lower than 1.1.0
Impacts on Installed System
Potential full system compromise.
How to Diagnose Installed System
- Check Firmware version using Core Manager, Peripheral Manager, Designer Configurator or RoomSuite. If the firmware version is lower than 10.4 or respective RoomSuite Modular System Firmware 1.1.0 your system is vulnerable.
- or
- Check Core Manager, Peripheral Manager, Designer Configurator or RoomSuite if your system is configured with Access Control or Password Protection. If your system is running in unprotected mode, it is vulnerable to this advisory.
- Note: If Access Control is Enabled, authentication is required to exploit the vulnerability.
Mitigation
Update to Q-SYS Designer Version 10.4 or higher
Update to RoomSuite Modular System Firmware 1.1.0 or higher
or
Enable Access Control and Password Protection on all devices.
Note: If Access Control is Enabled, authentication is required to exploit the vulnerability.
Refer to the Q-SYS Secure Deployment Guide available at the following location for more information on securing a Q-SYS installation: Secure Deployment Guide
Updated Version
Q-SYS Designer 10.4.
RoomSuite Modular System Firmware 1.1.0
Issue Fixed Date
29 September 2026
Attribution
The issues were identified by Andrew Furlani, a security researcher who focuses on AV systems and solutions.
Acuity knows of no exploitation of these vulnerabilities.
LEGAL DISCLAIMER:
THIS CONTENT IS PROVIDED ON AN "AS IS" BASIS FOR INFORMATIONAL PURPOSES ONLY AND IS PROVIDED WITHOUT ANY WARRANTY OF ANY KIND. THE CONTENT IS INTENDED FOR USERS OF ACUITY PRODUCTS WHO POSSESS THE PROFESSIONAL SKILLS AND JUDGMENT NECESSARY TO INTERPRET THE INFORMATION AND DETERMINE THE APPROPRIATE STEPS TO TAKE. USE OF THE INFORMATION IS AT THE USER'S OWN RISK. THE AUTHOR RESERVES THE RIGHT TO UPDATE OR DELETE THIS CONTENT AT ANY TIME.
