The vulnerability allows a low‑privileged remote attacker to enumerate projects and usernames by sending iterative requests to a specific endpoint within the Wago Smart Designer web application. This weakness can be classified as an unauthorized disclosure of data, as it reveals potentially sensitive information about projects and user accounts without proper authentication or authorization controls. The impact is a compromise of confidentiality, as attackers can gain insight into the structure and users of the system.

The weakness appears in Wago Smart Designer version 2.33.1 and earlier. Systems running these or older versions are potentially affected. Higher versions are not listed as affected.

The CVSS score of 4.3 indicates low severity, and the EPSS score is unavailable, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation is likely to require remote access to the Smart Designer web interface, and the attacker does not need privileged credentials. While the impact is limited to information disclosure, the lack of availability or denial‑of‑service effects keeps the overall risk moderate.