This vulnerability arises from insecure permissions in AndFHEM version 2.4.1, enabling an attacker to modify another user's FHEM control settings without authorization. The attack does not require code execution but allows direct configuration changes, which could alter device behavior or grant further control. The weakness is a classic improper access control flaw, permitting privilege escalation within the app’s local environment.

The affected product is AndFHEM, a mobile interface to the FHEM home‑automation platform, distributed under the name klassm AndFHEM. The known vulnerable release is version 2.4.1 (build 241). Vendor information is not specified in the CNA data, but the application is available from the F‑Droid repository and associated GitHub repositories.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided, so the exact severity cannot be quantified, but the presence of an unchecked permission means local users or attackers with device access could exploit the flaw. Attack vector and prerequisites are not detailed, so the likelihood remains uncertain. However, given that the flaw permits arbitrary configuration changes, the potential impact is high if the attacker gains any level of device or app access.