A flaw in the TSplus Remote Access web server permits an unauthenticated attacker to bypass protections and view secret data by manipulating request paths to the "/socket.io/JWN/" endpoint. The vulnerability is a classic example of improper access control (CWE-552) that can expose sensitive internal files or proprietary configurations. It does not require any user credentials or prior compromise of the machine. The consequence is data disclosure and potential further lateral movement within the organization.

The affected software is TSplus Remote Access version 19.20.3.10. Versions derived from the same code base prior to the patch are also impacted, with precise enumerated versions noted in the vendor’s advisory. The product runs as a web server hosting remote desktop services for Windows, Linux, and macOS clients.

The CVSS score of 8.7 labels this flaw as High, reflecting significant impact if exploited. The EPSS score is not available, so the current exploitation likelihood remains uncertain, but the vulnerability is reachable from any IP that can reach the TSplus instance, making it potentially useful to attackers. The flaw is not listed in the CISA KEV catalog, but its high severity and remote nature mean that exploitation could occur without side‑channel assistance. In practice, a remote attacker would craft a crafted URL to the vulnerable endpoint, gaining unauthenticated read access to protected internal resources.