The vulnerability arises from incorrect default permissions in the Tetra Connectivity Server. An attacker who can trick a user into dropping a crafted file into a vulnerable directory may trigger arbitrary code execution with SYSTEM privileges. This escalates a user‑level process to the highest local privilege on the Windows Server, compromising confidentiality, integrity, and availability of the system.

Affected systems include the AIRBUS Tetra Connectivity Server version 7.0 running on Windows Server operating systems.

The CVSS score of 5.6 indicates moderate severity, and the EPSS score is not available, meaning the exploitation probability is undetermined. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to place a file in a specific directory, typically through social engineering or user cooperation. Once that condition is met, privilege abuse can occur.