This vulnerability in the Security component of Oracle Communications BRM – Elastic Charging Engine allows an unauthenticated attacker who can reach the physical network segment where the engine runs to perform unauthorized actions such as creating, deleting, or modifying critical data, as well as reading a subset of the engine's data. The flaw does not grant privileges to read all data, but it does enable significant data integrity damage and limited confidentiality exposure. The weakness is consistent with improper access control.

Affected software is Oracle Communications BRM – Elastic Charging Engine, versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. The issue resides in the Security component and applies to installations where the engine is exposed to the physical communication segment—typically an internal network or dedicated link.

The CVSS 3.1 base score of 5.9 indicates a medium severity with elemental confidentiality and high integrity impact. The attack vector (AV:A) implies that an attacker must have physical or adjacent network access, making exploitation hard but not impossible. Since EPSS is unavailable, the exact exploitation probability cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. The lack of required user interaction or network privileges further limits ease of exploitation, but if an internal adversary gains access to the relevant segment they can modify or delete critical data. Until a vendor update is released, limiting physical network access and monitoring for unauthorized changes is advised.