The flaw allows an attacker to overwrite arbitrary internal files during the file import routine of the application. By replacing critical files, the attacker can execute code of their choosing or expose sensitive information. The weakness is reflected in CWE-22, which deals with path traversal or manipulation, and CWE-73, which covers absolute path traversal, indicating that the file system is improperly validated and controlled.

The vulnerability affects the UXGROUP LLC Cast to TV Screen Mirroring application, version 2.2.77, which runs on Android devices. No other product or version information was provided.

With a CVSS score of 9, the flaw represents high severity, and while the EPSS score is less than 1% suggesting that existing exploitation activity is low, the potential for remote code execution remains serious. The likely attack vector is remote, based on delivering a specially crafted file through the import feature—probably over a local network or via an untrusted file source—though the exact deployment method is not detailed in the description. The absence of a listing in the CISA KEV catalog does not diminish the inherent risk of this remote code execution capability.