The vulnerability originates from hard‑coded credentials embedded within the Avantra platform, allowing an entity to authenticate as a privileged user without proper credentials. This unauthorized access grants the ability to invoke functionality that is not correctly restricted by access control lists. The primary impact is the potential for data disclosure, manipulation, or other actions that compromise the confidentiality, integrity, and availability of the system. The weakness is classified as CWE‑798: Improper Validation or Use of Hard‑encoded Credentials.

The affected product is Syslink software AG’s Avantra platform. The issue exists in all releases prior to version 25.3.0, as stated by the vendor: "This issue affects Avantra: before 25.3.0." No further version details are provided.

The likely attack vector is remote network interaction when the application is exposed, as the hard‑coded credentials can be used over the network. Based on the description, it is inferred that local execution of the application would also permit use of the credentials. The CVSS base score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits. Nonetheless, the possibility of privileged access warrants prompt mitigation.