This vulnerability allows an authenticated low-privilege attacker to perform SQL injection on an endpoint in the AXC F 1152 controller's web interface. The injection targets a SQLite database that stores notification messages, restricting the impact to notification-related data. No indication of remote code execution or broader system compromise is provided. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, low privileges required, and no user interaction needed.

The impact is limited to the notification functionality of the affected system. Exploitation could allow manipulation or unauthorized access to notification messages stored in the SQLite database. There is no evidence of impact beyond this scope, such as control over the device or access to other system components.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the web interface to trusted users only and monitor for suspicious activity related to notification management.