A critical client-side security flaw in JNC IAQS and I6 devices allows unauthenticated attackers to escalate privileges and gain full administrator access.

This vulnerability involves the improper enforcement of security controls on the client-side (CWE-603), enabling an unauthenticated remote attacker to bypass authentication mechanisms and achieve administrative privilege levels.

The ability to gain administrative privileges without authentication represents a total loss of confidentiality, integrity, and availability. With a CVSS score of 9.8, this vulnerability poses a severe risk of unauthorized system modification and long-term persistence by malicious actors.

Immediate Action: Verify hardware chipsets (M3 vs M4) with the vendor; apply available patches for M4-based units or initiate hardware replacement for M3-based units.

Proactive Monitoring: Monitor network traffic for unusual patterns in web interface requests and inspect logs for unauthorized administrative login events.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block suspicious requests directed at the administrative web interface and enforce strict network segmentation.

Public Exploit Available: Unknown

This vulnerability is highly critical and requires immediate attention to prevent unauthorized administrative escalation. Administrators should treat these devices as compromised if they cannot be immediately patched or isolated from network access.