Author: Marius Creutznacher
| Risk Category: High | Document ID: QSYS-October-19-9006 |
| Document Version: 1.0 | |
| Document Status: Final |
Description:
An unauthenticated attacker with network access to an affected Q-SYS Core may be able to exploit insufficient validation of a user-controlled file reference used by a logging function. This may allow data to be written outside the intended logging area and affect protected system content. The most likely outcome is service disruption or denial of service; depending on the affected content, broader integrity impact may also be possible.
| CVE ID: | CVSS Vectors: | Score: |
| CVE-2026-88461 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/ SI:N/SA:N |
8.8 High |
Impacted Product Name
Q-SYS Core Processors
Impacted Versions
Q-SYS Designer Version lower than 10.5.0
Impacts on Installed System
Successful exploitation may affect system integrity and availability, including service disruption, denial of service, and possible broader compromise of the affected device.
How to Diagnose Installed System
Confirm whether the Core runs firmware earlier than 10.5.0 and determine whether the device is reachable from untrusted or insufficiently segmented networks.
Mitigation
- Install Q-SYS Designer version 10.5.0.
- Restrict network access to the Core, segment the device from untrusted networks, and monitor for unexpected service disruption or system changes until the fixed release is installed.
Updated Version
Q-SYS 10.5
Issue Fixed Date
29 September 2026
Attribution
National Test Institute for Cybersecurity NTC, https://www.ntc.swiss/
Acuity knows of no exploitation of these vulnerabilities.
LEGAL DISCLAIMER:
THIS CONTENT IS PROVIDED ON AN "AS IS" BASIS FOR INFORMATIONAL PURPOSES ONLY AND IS PROVIDED WITHOUT ANY WARRANTY OF ANY KIND. THE CONTENT IS INTENDED FOR USERS OF ACUITY PRODUCTS WHO POSSESS THE PROFESSIONAL SKILLS AND JUDGMENT NECESSARY TO INTERPRET THE INFORMATION AND DETERMINE THE APPROPRIATE STEPS TO TAKE. USE OF THE INFORMATION IS AT THE USER'S OWN RISK. THE AUTHOR RESERVES THE RIGHT TO UPDATE OR DELETE THIS CONTENT AT ANY TIME.
