AhnLab EPP Management v1.0.14.32‑6249 contains a NoSQL injection flaw in the eventlog/agentEvent/list endpoint. The CVE description does not state authentication requirements, so it is inferred that both unauthenticated and authenticated attackers could exploit this. This can lead to unauthorized data disclosure or modification, compromising the confidentiality and integrity of sensitive operational logs and potentially exposing system configuration information. The vulnerability aligns with CWE‑943, reflecting a lack of input validation for imported data.

AhnLab EPP Management v1.0.14.32‑6249 is the only version explicitly affected by this NoSQL injection vulnerability are earlier versions may contain similar unvalidated input handling that could expose the same risk.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score of <1% is currently unlikely but possible, especially if the vulnerable endpoint is exposed to untrusted network traffic. The vulnerability is not listed in the CISA KE are no documented large‑scale exploits. Attackers would need to send crafted requests to the eventlog/agentEvent/list endpoint, likely from a remote system; it is inferred that the lack of input validation would make this straightforward once access is achieved.