An unsigned application installer bypasses the expected cryptographic signature verification in PAX Technology Q80, allowing an attacker on a network‑adjacent position to deliver a malicious installer that runs with root privileges. Because no authentication is required, a remote user can cause arbitrary code execution, effectively compromising the entire system and any services it hosts.

The flaw affects installations of PAX Technology Q80. No specific version details are provided, so all deployments of Q80 that have not applied a vendor patch that restores signature verification are vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability, but the lack of an EPSS score indicates uncertainty about its exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known active exploits at this time, although its remote code execution capability combined with the lack of authentication makes it attractive to adversaries who have network proximity to the target.