Improper access control in the removable media validation function allows a local attacker with administrative privileges to bypass the file lockdown mechanism, enabling the unauthorized transfer of files to the victim device. The attacker must have placed an unauthorized file on the removable media beforehand. The result is that privileged local users can move files into protected areas, potentially exposing sensitive data or permitting further malicious activity.

TXOne Networks products SafePortAgent versions earlier than 3.2.5024 and StellarProtect versions from 3.2.4011 through 5.0.1082 are affected. Administrators managing these deployments are at risk when removable media is used.

The CVSS score of 6.7 classifies the issue as medium severity, but the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation requires a local administrator with physical or logical access to the removable media to pre‑load a malicious file, after which the file can be transferred to the system without restriction. The attack path is therefore limited to environments where administrators have full control of device media but are unaware of the lockdown bypass.