The vulnerability permits an attacker to reach diagnostic endpoints without authentication, exposing data such as password hashes and database table names. This results in a confidentiality compromise. The weakness appears to be an improper configuration that allows information exposure and improper access control, as reflected by the inferred CWEs CWE‑200 and CWE‑284.

Only installations of Sage DPW version 2025_06_004 are affected, because the Database Monitor diagnostic interface is enabled in this build. The feature is disabled by default in all installations and is removed in the preceding build 2025_06_003, and it is never available in Sage DPW Cloud. Vendors are not identified in the attribution data.

The CVSS base score of 5.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector is a remote network connection to the unprotected diagnostic endpoints; no privilege elevation or additional setup is described. Because the exposed data is sensitive, the risk remains non-trivial and warrants timely remediation.