This vulnerability affects the On-Chip Debug Interface in Johnson Controls Neo Series MVP2 devices with versions prior to 3.3b63. It permits unauthorized collection of data from common resource locations, potentially exposing sensitive information. The CVSS 4.0 vector indicates network attack vector with high attack complexity and no privileges required, but user interaction is needed. The vulnerability has high impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor advisories with patch information are currently available.

An attacker could remotely collect data from common resource locations on affected devices without requiring privileges, potentially leading to information disclosure and compromise of device confidentiality, integrity, and availability. The high CVSS score reflects the severity of this impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure of affected devices to untrusted networks and restrict user interaction where possible.