The CVE describes an authentication bypass that allows an unauthenticated attacker to trigger a full re‑installation by accessing the /setup/ folder in Xerte Online Tools. During this re‑installation the attacker can provide a custom database connection string, which causes the application to bind to a database they control. In effect, the attacker bypasses normal authentication and gains the ability to execute arbitrary code on the host. The weakness is related to CWE‑284 and CWE‑287.

This flaw affects the Xerte Online Tools web application. No specific versions are listed in the CVE data, so any installation of Xerte Online Tools that exposes the /setup/ directory during or after deployment may be vulnerable. Administrators should verify whether the /setup/ directory remains accessible in their environment.

The flaw carries a CVSS score of 9.1, indicating critical severity, while the EPSS score of less than 1 % shows that the likelihood of exploitation is currently low. The vulnerability is not included in CISA’s KEV catalogue. Attackers can exploit it by sending unauthenticated HTTP requests to the /setup/ endpoint, leveraging the lack of authentication on that path. Once the re‑ completes, the attacker can supply a database connection that points to a remotely controlled database, effectively taking control of the application.