The CVE arises from incorrectly set permissions on the autostart1.tscr shared login scripts within TSplus Remote Access, a CWE‑276 (Incorrect Permissions) flaw. Users lacking sufficient privileges can write to these files, allowing a local attacker with a valid session on the terminal or remote desktop server to modify them. When another user logs in using the same theme or operating mode, the manipulated scripts execute arbitrary commands in that user's security context, potentially enabling lateral movement or privilege escalation.

This vulnerability affects TSplus Remote Access version 19.20.3.10. Installations where the shared themes directory is writable by non‑privileged users are susceptible. The issue has been resolved in the most recent TSplus release.

The severity is rated at a CVSS score of 5.4, indicating moderate risk. EPSS score is below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to already have a valid session on the terminal or remote desktop server and to be able to write to the shared scripts folder. Once the attacker modifies the autostart1.tscr file, the compromise occurs when another user logs in, providing cross‑user code execution or privilege escalation in a purely local context.