This vulnerability allows an authenticated low-privilege attacker to perform SQL injection on an endpoint in the controller’s web interface. The affected component is a SQLite database used exclusively for storing notification messages. Exploitation could lead to modification of notification data but does not affect system confidentiality or availability. The CVSS 3.1 base score is 4.3 (medium), reflecting low impact on confidentiality and no impact on availability. No known exploits are reported in the wild, and no patch or remediation information is currently available.

The vulnerability impacts the integrity of the notification messages stored in the SQLite database. There is no impact on confidentiality or availability of the system. The attacker must be authenticated with low privileges to access the vulnerable endpoint, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the controller’s web interface to trusted users only and monitor for suspicious activity related to notification management. No official fix or workaround is currently documented.