The vulnerability in the IFTOP application, identified as a Local File Inclusion flaw (CWE-98), allows unauthenticated remote attackers to execute arbitrary code on the server. The flaw permits inclusion of arbitrary files, enabling the attacker to run code with the privileges of the web server process. This results in a full compromise of confidentiality, integrity, and availability for the affected system. Key detail from vendor description: "IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server." Key detail from the CWE list: "CWE-98 (Local File Inclusion)."

Affected systems are those built on WellChoose's IFTOP software. All installations running versions earlier than IFTOP_P4_181 are vulnerable. The vendor recommends updating to IFTOP_P4_181 or a later release to eliminate the flaw. Key detail from known solution: "Update to verison IFTOP_P4_181 or later." No specific version mapping is provided beyond this upgrade path.

The CVSS score of 9.3 signals a critical severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited in known attacks. Key detail from scores: "CVSS Score: 9.3, EPSS Score: < 1%, KEV: not listed in KEV." Attackers can exploit the flaw over the network without authentication, borrowing the application’s privileges to execute arbitrary code. Consequently, the risk to affected deployments remains high if not patched.