A missing authentication check in the /servlet/baServer3 endpoint of Interinfo DreamMaker allows remote attackers to invoke critical administrative functions without any prior login. This flaw can lead to full administrator privileges, enabling the attacker to modify configurations, access sensitive data, or take control of the system, as reflected in the 9.3 CVSS score and its classification under CWE-306.

Internet Information Co., Ltd DreamMaker versions released before 2025‑10‑22 are affected. Any deployment of these versions is vulnerable until a patch or workaround is applied.

The vulnerability carries a high severity CVSS score of 9.3 but has an extremely low EPSS probability (< 1%). It is not listed in the CISA KEV catalog, indicating no publicly known exploits at the time of reporting. The likely attack vector is remote network access to the vulnerable HTTP endpoint, where an attacker can send crafted requests to exploit the missing authentication guard.