The ABB Cylon Aspect BMS/BAS controller before 3.08.02 allows unauthenticated users to execute arbitrary shell commands via the deployStart.php script. This vulnerability can be exploited to run the 'rundeploy.sh' script, which initializes the Java deployment server and configures settings, leading to unauthorized server initialization and potential performance issues.