The vulnerability exists because the RBG-100 recycler system includes executable binaries that are writable by unprivileged local users while being run by the root account. This file permission flaw allows an attacker with local access to replace or modify these binaries, which then execute with root privileges, thereby enabling arbitrary command execution as root. The weakness directly maps to the incorrect permission vulnerability identified by CWE-732.

Glory Global Solutions’ RBG-100 recycler systems that run the ISPK-08 software component are affected. No specific version numbers are cited, but all installations of this model that use the mentioned component are potentially impacted.

The CVSS score of 8.5 reflects a high severity, and the EPSS score of less than 1% indicates that at the time of this analysis there is a very low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of it being actively exploited in the wild. However, the local nature of the attack means that any user who gains physical or privileged local access to the device can exploit the flaw, potentially escalating privileges to root. The combination of a high CVSS score and the low EPSS suggests that while current exploitation risk is modest, the impact remains significant enough to warrant timely remediation.