The vulnerability allows an attacker to enter an embedded device using pre‑defined accounts that are hard‑coded into the Blue Angel Software Suite. Once authenticated, the attacker gains administrative control over the web interface and can modify configuration, install additional software, or cause a denial of service. This grants complete confidentiality and integrity compromise and can ultimately affect device availability.

All installations of the 5VTechnologies Blue Angel Software Suite running on embedded Linux that contain the hard‑coded default accounts. No specific product versions are listed, so any release with this weakness is potentially vulnerable.

The CVSS score of 9.3 indicates a severe risk. The EPSS score of <1% suggests a low probability of exploitation, but the vulnerability has already been demonstrated by the Shadowserver Foundation on January 26, 2025. Attackers can exploit the flaw remotely through the web interface, likely over a network accessible to them. The risk remains high because the vulnerability provides full administrative privileges without prior authentication.