Technical impact
The installed edition of the Electronic delivery item Inspection Support System suffers from an improper file access permission flaw that permits files within its installation directory to be modified. Such modifications can lead to the injection of malicious code, allowing an attacker to execute arbitrary commands on the host system. This vulnerability is reflected in CWE‑276 and presents a high risk to confidentiality, integrity, and availability if exploited.
Affected Systems
The affected product is the Electronic delivery item Inspection Support System distributed by the Japanese Ministry of Land, Infrastructure, Transport and Tourism. No specific version numbers were supplied in the advisory.
Risk and Exploitability
The CVSS score of 8.5 indicates high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation so far. Based on the description, the likely attack vector is local, requiring write access to the installation folder, which could be achieved by an authenticated user with sufficient privileges or by compromising a process that runs with elevated rights.
