This vulnerability exists in the Core component of Oracle Communications BRM – Elastic Charging Engine. A low‑privileged local user can easily exploit it to gain unauthorized access to the system, allowing them to read critical data. The CVSS 3.1 base score of 5.5 reflects a high confidentiality impact while leaving integrity and availability unaffected.

Affected versions are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. No patch or fix is listed in the provided data; users should monitor Oracle’s releases for an update.

The risk is moderate because the CVSS score is in the medium range and there is no exploitation probability score available. The vulnerability requires the attacker to be a low‑privileged user with access to the host where BRM runs, so local privilege escalation or compromised local accounts are the primary attack paths. The vulnerability is not listed in CISA’s KEV catalog, indicating no public exploits have been documented as of this analysis.