CVE-2026-34498: CWE-20 Improper input validation in Johnson Controls Illustra Standard - L4L China

This vulnerability in Johnson Controls Illustra Standard - L4L China is due to improper input validation, which enables an attacker to perform OS command injection on affected Windows systems. The affected versions are those before 6.0.0.66394. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, user interaction required, no confidentiality, integrity, or availability impact, but with low scope and high severity impact on security integrity.

Successful exploitation could allow an attacker with limited privileges and user interaction to execute arbitrary OS commands on the affected system. This could lead to unauthorized command execution but does not directly impact confidentiality, integrity, or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the input data. Until a patch is available, users should follow vendor guidance and consider restricting access or applying other compensating controls if possible.