Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
CWE-639