This vulnerability, identified as CWE-73, allows an attacker to externally control the file name or path used by Johnson Controls Airwall software versions prior to 4.1. This can result in unauthorized file manipulation. The CVSS 4.0 vector indicates the attack can be performed remotely without privileges or user interaction, with high impact on confidentiality and low impact on integrity and availability. No vendor advisory or patch information is provided, and no known exploitation has been reported.

Successful exploitation could allow an attacker to manipulate files on the affected system, potentially leading to unauthorized access or modification of sensitive data. The high CVSS score reflects the significant confidentiality impact and the ease of remote exploitation without privileges or user interaction. However, no active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.