Report One MyReport Updater exposes an unauthenticated gRPC service on TCP port 9095. Attackers can invoke the UpdateConfigReferent method to redirect the SYSTEM updater. By pointing the updater at a malicious reference server that serves modified module archives with matching MD5 digests, an attacker can write arbitrary files and execute code with SYSTEM privileges, giving full control of the affected system.

The vulnerability affects Report One MyReport Updater versions up to and including 2.1.1. Systems running these versions are susceptible unless mitigated.

The CVSS score of 9.2 classifies this flaw as critical. Attackers do not need authentication, so any network host can exploit the exposed gRPC service. The EPSS score of 0.00649 indicates a very low exploitation probability, but the lack of a KEV listing does not reduce the urgency, as the vulnerability grants SYSTEM‑level execution. The attack path is straightforward: connect to port 9095, call UpdateConfigReferent, and supply a malicious reference server. No additional prerequisites are required beyond network connectivity.