The vulnerability arises from incorrect permission assignment on a critical resource within Owl opds 2.2.0.4, allowing an attacker to craft a network request that causes the victim system to write to or modify that resource. This enables arbitrary file manipulation such as tampering with configuration files, logs, or sensitive data and could ultimately allow an attacker to alter system behavior or inject malicious code.

The flaw affects Owl CyberDefense’s Open Platform for Digital Security (opds) product line, notably firmware and hardware associated with the opds‑1000 and opds‑100 models, as well as the opds‑talon version 2.2.0.4. Any installation running these components with the default configuration is potentially vulnerable.

The CVSS v3 score of 8.5 indicates high severity. EPSS indicates a very low but non‑zero probability of exploitation. It is not on the CISA KEV list. The attack vector is inferred to be remote, as a crafted network request can trigger the vulnerability from outside the device.