A missing authentication check in a critical function of Vimesoft’s Enterprise Video Platform allows attackers to bypass authentication and access functionalities that normally require valid credentials. This vulnerability, classified as CWE‑306, could enable an attacker to read or modify protected video content, configuration settings, or administrative data, thereby compromising confidentiality and integrity of the platform. The impact is significant for systems where sensitive video or user information is stored.

The vulnerability affects Vimesoft Inc.’s Enterprise Video Platform versions starting at 3.11.0.0 and all builds prior to 3.25.0.0. Systems running any of these releases are potentially exposed unless intervening configurations mitigate the missing authentication requirement.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, and no publicly disclosed exploits are known. Attackers are likely to target the platform over the network by sending crafted requests to the vulnerable endpoint, but no special privileges are required other than network connectivity. Prompt remediation is advised given the potential for unauthorized data access.