The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-38448
• https://us-cert.cisa.gov/ics/advisories/icsa-21-266-01