The vulnerability is a case of incorrect access control in Northern.tech CFEngine Enterprise, allowing an attacker to gain unauthorized access to privileged operations or sensitive data. It falls under the category of improper access control weaknesses. The attack can lead to data compromise, system modification, or disruption of services depending on permissions granted by the compromised account.

The affected products are Northern.tech CFEngine Enterprise releases prior to version 3.21.8, 3.24.3 and 3.27.0. Systems running these older CFEngine versions are susceptible to the flaw.

The CVSS score is 5.3, and the EPSS score is < 1%, indicating a low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. Based on the nature of the flaw, the likely attack vector could be remote or local, depending on network exposure and authentication mechanisms. The weakness permits unauthorized access to functionalities that should be restricted, allowing an attacker to potentially read, modify, or delete configuration data or execute privileged commands.