Venere loads unsigned components from a writable installation directory. An attacker who can write to that location may drop a malicious component that the application will load, executing arbitrary code with the privileges of the Venere process. The weakness is an Untrusted Search Path (CWE-427).

Any installation of Venere produced by CompuGroup Medical that places its components outside the protected Program Files area is potentially vulnerable. No specific version numbers are disclosed, so systems following the described deployment pattern remain at risk.

With a CVSS score of 5.9, the vulnerability is classified as medium in severity. The attack vector appears to be local, requiring write access to the installation folder, and no EPSS score is available. The issue is not listed in CISA’s KEV catalog, suggesting limited public exploitation. Nevertheless, if an attacker can create files in the vulnerable directory, they could achieve privilege escalation or compromise of the system by loading malicious code into the Venere process.