The vulnerability in iRM-IEI Remote Management is a Hardcoded Credentials flaw that allows unauthenticated attackers to use preset credentials to access the device’s database with administrative rights. This direct privilege escalation could enable attackers to read, modify, or delete configuration data, and potentially further compromise the system. The weakness falls under CWE-798, indicating insecure handling of secrets within the software.

IEI Integration Corp’s iRM-TSi410X product is affected. Specific vulnerable versions are not listed in the available information.

The CVSS score of 9.3 indicates a critical severity, and the EPSS score is not available, so no quantifiable exploitation probability can be provided. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote network-based interaction with the device’s management interface, where the hardcoded credentials can be exploited by unauthenticated users striving to gain administrative access.