Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control. This lack of authentication (CWE‑306) allows an attacker to read or modify the engine’s settings, effectively compromising the confidentiality, integrity, and availability of the device. The exposed interface can be used to alter operational parameters or to initiate actions that are normally restricted to authorized users.

The only affected product identified by the CNA is Avation Light Engine Pro from Avation. No specific version range is reported, so all installations of the product are potentially vulnerable unless the vendor confirms a fix for a particular release.

The vulnerability has a CVSS score of 9.3, indicating a high severity level, but the EPSS score is less than 1 percent, suggesting a low probability of exploitation at this time. The issue is not listed in CISA’s KEV catalog, implying no confirmed active exploitation. A likely attack vector is remote, inferred from the description that the configuration interface is exposed over a network. An attacker who can reach the interface would be able to perform unauthorized actions until a vendor remediation is applied.