This vulnerability permits an unauthenticated remote attacker to access the access keys, secret keys, and deployment secrets stored within the tunnel gateway and provisioning interfaces of EagleCloud Aquila. By abusing authentication mechanisms, the attacker can elevate privileges and harvest credentials, a weakness mapped to CWE‑522.

EagleCloud Aquila on‑premises installations through version 2.6.7.2 are affected. Systems that have not applied the vendor’s security update risk exposure of sensitive keys and elevated access rights.

The CVSS score of 8.7 signals a high severity. Although the EPSS score is not available and the flaw is not yet listed in the CISA KEV catalog, the ability to obtain secrets without prior authentication makes the vulnerability an attractive target for attackers. Exploitation requires only network access to the vulnerable interfaces, making it highly actionable for remote adversaries.