The vulnerability resides in the IRIS web application where the OTP validation process is not protected from brute‑force attempts. Attackers can repeatedly submit one‑time passwords until they succeed, potentially granting them unauthorized access to user accounts. This weakness is classified as CWE‑770, indicating an uncontrolled resource consumption issue that may also lead to denial of service if the system depletes resources or crashes.

The affected product is the DFIR‑IRIS IRIS Web application, version 2.4.26 and possibly earlier or later releases. Only the 2.4.26 version is explicitly mentioned in the advisory, but the security notice indicates that the issue may exist in other versions as well. Administrators should verify the exact version they are running and review the vendor’s documentation for any patches or updates.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is below 1 %, which suggests that the likelihood of exploitation is low in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. However, the attack path is likely via the web‑facing OTP validation endpoint, allowing an attacker to attempt many guesses over the network. No special configuration or privilege is required beyond access to the login interface, but repeated attempts may eventually succeed if no rate‑limiting or additional authentication steps are in place.