Technical impact
This vulnerability allows files or directories within the ABB T-MAC Plus web application to be read by external parties. The weakness grants attackers unauthorized access to potentially sensitive configuration and log data, resulting in a breach of confidentiality. It is classified as CWE-552.
Affected Systems
The issue affects ABB T-MAC Plus versions 4.0 through 24. No other product versions are listed as affected.
Risk and Exploitability
The CVSS score of 7.3 indicates high severity, and although an EPSS score is not provided, the lack of a known exploit in KEV does not diminish the risk. Attackers can exploit the flaw remotely via a web request without authentication, making it straightforward to retrieve arbitrary files. The high predatory nature of the vulnerability warrants prompt remediation.
