The vulnerability is found in Freedom Factory dGEN1 firmware up to 20260221, affecting the AndroidEthereum function of the org.ethosmobile.webpwaemul component. It leads to improper access controls that allow a remote attacker to execute privileged operations or gain unauthorized data access. The weakness falls under CWE-266 (Use of a Trusted Resource by an Unauthorized Entity) and CWE-284 (Improper Access Control). Because the exploit is publicly available, the threat of remote exploitation exists, albeit with high complexity and difficulty.

The affected product is Freedom Factory dGEN1, specifically firmware versions up to 20260221. No other models or versions are listed as impacted. The component in question is org.ethosmobile.webpwaemul within the AndroidEthereum subsystem. Attackers would need to target devices running these specific firmware revisions to exploit the flaw.

The base CVSS score of 2.3 indicates low severity, and the EPSS score of <1% suggests a very low current likelihood of exploitation. However, the publicly disclosed exploit makes the vulnerability realistic for an attacker who can invest the high complexity effort. The security breach would enable unauthorized access to functions intended for authenticated or privileged use, potentially exposing sensitive data or control over the device. The vulnerability is not listed in the CISA KEV catalog, and the vendor has not responded to disclosure, so mitigation relies on user‑driven controls and any future firmware fixes.