Q-SYS Peripherals Remote Code Execution due to unauthenticated installation script

Acuity is aware of the recently disclosed PHP2Shell vulnerabilities that are affecting organizations across multiple industries.

An authenticated attacker with network access to an affected Q-SYS Core may be able to abuse insufficient validation during the processing of uploaded package content.

An unauthenticated attacker with network access to affected Q-SYS Core may be able to abuse insufficient separation between externally reachable control functionality and privileged internal services.

An unauthenticated attacker with network access to an affected Q-SYS Core may be able to exploit insufficient validation of a user-controlled file reference used by a logging function.

An authenticated attacker with management access and network connectivity to an affected QSYS Core may be able to abuse insufficient validation and authorization of file access requests.

Affected Q-SYS Core firmware contains shared authorization material for an optional administrative service (“Secure Maintenance & Support“).

A critical vulnerability was discovered in the Linux kernel's algif_aead cryptographic algorithm interface and was assigned CVE identifier CVE‑2026‑31431.

Q-SYS Core Processors do not require an administrator to set up remote authentication during configuration, allowing a remote, unauthenticated attacker to perform various privileged actions.

Q-SYS Core Processors contain a remote command injection vulnerability. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges.

Security vulnerabilities identified in the Niagara Framework®, fixed and updated software is now available.

Security Vulnerability Announcement on SOLSTYCE DALI Gateways. Fixed software is available.

A critical vulnerability in Apache Log4j, a logging subsystem commonly used in Java-based applications and solutions, was identified and assigned CVE identifier CVE-2021-44228.

Organizations must protect and secure their data by cultivating a security culture and investing in ongoing cyber and application security awareness training to avoid potential breaches.

nLight ECLYPSE (nECY) system controllers contain a default key vulnerability. The nECY does not force a change to the key upon the initial configuration of an affected device.

Acuity Brands is aware of the “SolarWinds Hack” currently reported in the news.

The DGLux Server contains a directory traversal vulnerability within the REST API component. The vulnerability impacts DGLux Server builds 1494 and prior.