The vulnerability exists in iDS6 DSSPro Digital Signage System 6.2 and is a CAPTCHA security bypass (CWE‑307). An attacker can request the autoLoginVerifyCode object and retrieve valid CAPTCHA codes from the login endpoint. These codes can then be used to perform brute‑force attacks against user accounts, ultimately bypassing the system’s authentication mechanism. This flaw permits unauthorized access to protected resources without legitimate credentials, compromising confidentiality and potentially granting elevated privileges.

Vendors: Yerootech. Product: iDS6 DSSPro Digital Signage System. Version: 6.2. No other versions are listed as affected in the current data.

The CVSS score of 9.3 marks this flaw as Critical, indicating a severe risk when exploited. The EPSS score is not available, though the lack of KEV listing suggests no confirmed mass exploitation yet. Based on the description, the likely attack vector is remote HTTP request to the system’s login endpoint, where an attacker can retrieve the CAPTCHA code and then attempt password guessing. If successful, an attacker could gain full access to the web interface and any connected media resources.