The vulnerability is a missing authentication mechanism in the EasyShare module, which can lead to data leakage if specific conditions on a local network are met. The weakness is identified as CWE‑306 (Missing Authentication for a Function or Operation). This flaw may allow a local attacker to access sensitive data stored or transmitted by the EasyShare feature, thereby compromising confidentiality but not impacting system integrity or availability.

The affected product is vivo EasyShare, a feature in vivo devices. Affected versions are not explicitly enumerated in the vendor data; therefore, all currently deployed EasyShare implementations should be considered at risk until the vendor issues a fixed version.

The CVSS base score is 6.9 (medium). EPSS indicates the probability of exploitation is less than 1 %, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local network based on the description, which suggests that an attacker with local network access could exploit the flaw. Immediate patching is recommended since the vulnerability could expose sensitive data.