The vulnerability is a missing authentication and authorization check in the web API of TCS Cognix Recon Client v3.0. It allows an attacker who can reach the API over the network to invoke endpoint functionality without any form of credential verification. The result is that the attacker can exploit the application's logic without restriction, effectively bypassing all intended access control, which constitutes a significant confidentiality and integrity risk for the data handled by the solution.

This flaw affects the TCS Cognix Platform v3.0. No other versions or vendors are listed as impacted. If your deployment uses Cognix Platform 3.0, the web API endpoints are vulnerable.

With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score is less than 1%, indicating a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network, targeting the exposed web API. An attacker only needs network connectivity to the API services; authentication bypass will grant them unrestricted use of the functionality provided by those endpoints.