An incorrect default permission setting on the Visionline webserver directory allows a local user to place a malicious executable with elevated privileges. The vulnerability is classified under execution with unnecessary privileges, incorrect permission assignment, and improper enforcement of correct permissions. An attacker who can write to this directory could replace a legitimate file with a malicious payload and gain elevated local privileges, thereby compromising the underlying Windows system.

ASSA ABLOY Visionline on Windows, versions 1.0 through 1.32 (i.e., any release before 1.33). The affected component is the webserver directory located at C:\ProgramData\ASSA ABLOY\Visionline.

The CVSS score of 5.8 indicates moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local account that has permission to write to the Visionline webserver folder; an attacker can replace executables there, leading to local privilege escalation.