The issue concerns the CodeSupport.ocx ActiveX control used by Sony, which has "safe for scripting" enabled. This allows remote attackers to execute arbitrary code by calling vulnerable functions such as RebootMachine, IsAdministrator, and ExecuteCode.