Hydrosystem Control System fails to enforce authorization for specific directories, allowing an unauthenticated user to read every file there and to execute selected files, including PHP scripts that interact directly with the connected database. This flaw can lead to data disclosure, modification and ultimately full remote code execution. The weakness corresponds to the missing authorization class of vulnerabilities.

The vulnerable product is Hydrosystem Control System. All releases before version 9.8.5 are susceptible; version 9.8.5 and later include the fix and are no longer affected.

The CVSS score of 8.8 signals a high‑severity issue. No EPSS score is published and the vulnerability is not listed in the CISA KEV catalogue, but based on the description the likely attack vector is via unauthenticated HTTP requests to the affected directories. It is inferred that an external network user could simply request these directories to read or execute files, potentially gaining full control over the system. The combination of high severity and ease of exploitation results in a high overall risk that should be addressed swiftly.