An authenticated attacker with high privileges can call a hidden configuration method that is not intended for user access. This flaw allows the attacker to change critical program parameters, leading to a complete loss of confidentiality, integrity, and availability as described in the advisory. The weakness falls under CWE‑425, a security policy violation where access controls are not properly enforced.

The vulnerability impacts MB Connect Line products, specifically mbCONNECT24 and mymbCONNECT24, version 2.20.1. Users of these versions should verify that they are running this software, as the hidden configuration method is present in the affected releases.

The CVSS score of 8.6 indicates a high severity impact. The EPSS score is not available, so the exploitation probability is unknown, but the lack of a KEV listing suggests it is not actively exploited in the wild. The attack vector is inferred to be remote, requiring an attacker already authenticated with high privileges, which is plausible in a breached or manipulation scenario. Given the potential for complete disruption, the risk remains high until the flaw is remediated.