The vulnerability lies in Changing's IDExpert Windows Logon Agent, where an attacker can force the system to download and execute arbitrary executable files without authentication. This flaw effectively allows remote code execution, a high‑severity risk (CWE‑494). The impact is immediate compromise of system integrity and confidentiality, as any program can be run with the privileges of the logon agent.

The affected product is the IDExpert Windows Logon Agent from Changing. No specific version information was included in the CNA data, so all installed instances of this agent remain potentially vulnerable until a patch is applied.

With a CVSS score of 9.3, this flaw is considered critical. The EPSS score of <1% indicates a low current probability of exploitation, yet the lack of constraints on authentication and the ability to download any executable make it a potent threat. The vulnerability is not listed in the KEV catalog, but the potential for remote, unauthenticated attacks warrants high vigilance. An attacker most likely would communicate over the network to the agent’s listening interface, trigger the download routine, and execute the supplied binary.