The IDExpert Windows Logon Agent contains a flaw that allows an unauthenticated attacker to command the system to download and execute arbitrary DLL files from a remote source. This flaw can lead to complete compromise of the affected machine by executing malicious code with the privileges of the agent process, classified as CWE‑494 for downloading untrusted binaries.

All installations of the Changing: IDExpert Windows Logon Agent running on Windows operating systems are affected. The vulnerability applies to any currently deployed version of the product, as no specific version was identified in the advisory.

The CVSS score of 9.3 reflects the high severity of this remote code execution vulnerability. However, the EPSS score of less than 1% indicates that exploitation remains unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to the target system and could exploit the agent without authentication, making this a remote, unauthenticated vector that could be leveraged from outside the local network if the agent is reachable.