Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control mechanisms, classified as CWE-306 (Missing Authentication for Critical Function). This allows unauthenticated attackers to access and potentially manipulate critical functions remotely over the network. The vulnerability affects all versions of the product and has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges, and no user interaction needed. No patch or vendor advisory detailing remediation is currently available.

An attacker can remotely access and control critical functions of Avation Light Engine Pro without any authentication, potentially leading to unauthorized configuration changes or control over the device. This could severely impact the availability, integrity, and confidentiality of the system managed by the product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the configuration and control interface to trusted administrators only, using network segmentation or firewall rules to limit exposure.