The vulnerability is caused by KTM System e‑BOK enforcing a maximum password length of six numeric digits and disallowing any alphabetic, special, or extended characters. This restriction on password complexity is explicitly stated in the CVE description, but the statement that it makes enumeration or brute‑force trivial and leads to account takeover is inferred from the weakness stated. The CWE‑521 classification confirms the issue involves weak password protection.

The affected system is KTM System e‑BOK. All releases prior to the patch published in June 2026 lack the fix. Users running any version before that date are susceptible to the weak password enforcement failure.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The description suggests weak password enforcement; however, the specific likelihood that attackers will exploit repetitive login attempts against the public authentication endpoint is inferred from the trivial constraints. Attackers can quickly gain unauthorized access, compromising user accounts and potentially sensitive data.