The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.
CWE-78