Sky Co.,LTD. products SKYMEC IT Manager and SKYSEA Client View allow a non‑administrative user to create or modify files in their installation directory because the directory is written with overly permissive access settings. This misconfiguration permits the execution of arbitrary code with the privileges that the product runs under, effectively giving the attacker administrative access within the system. The flaw is a Permissions Issue (CWE‑276) and can compromise confidentiality, integrity and availability of affected systems.

The vulnerability affects Sky Co.,LTD. SKYMEC IT Manager and SKYSEA Client View. Specific version information is not supplied in the CVE data, so all installed versions of these products should be considered potentially vulnerable until a vendor update is applied.

The CVSS score of 8.5 marks this as a high‑severity issue. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack path is local: a non‑admin user can place malicious files in the installation folder, though the affect may be amplified if an attacker can remotely inject files through exposed services or network shares. The lack of hard evidence for exploitation means the actual risk may be lower than the score alone suggests, but the potential for full administrative compromise warrants immediate action.