In N2W software versions older than 4.3.2 and 4.4.x older than 4.4.1, a spoofing vulnerability permits attackers to execute arbitrary code remotely and obtain account credentials. This flaw arises from incorrect permission assignment for critical resources (CWE-290). The result is total compromise of confidentiality, integrity, and availability, allowing attackers to gain unrestricted system access and exfiltrate sensitive data.

The affected vendor is N2W, product N2W. Versions before 4.3.2 and before 4.4.1 are impacted. The vulnerability is present across all prior releases up to and including those versions, affecting organizations that have not yet applied the patch released in N2W V4.3.2 and V4.4.1.

The CVSS score of 9.8 places the flaw in the critical severity range, while the EPSS score of less than 1% suggests a low probability of exploitation. It is not captured in the CISA KEV catalog. Based on the description, the attack vector is likely remote, with the attacker exploiting the application logic over the network, possibly through web interfaces or API calls. Exploitation requires the ability to send crafted requests that are treated as legitimate user actions, hence the spoofing context.