The vulnerability resides in Netatalk's DES‑ECB authentication mechanism, where the time taken to process authentication data leaks information about the validity of the supplied credentials. This timing side channel (CWE‑208) permits an attacker to measure response times and deduce whether authentication attempts are correct, enabling gradual discovery of valid credentials and facilitating brute‑force attacks with reduced effort.

Netatalk versions 1.5.0 through 4.4.2 are affected. The product is the Netatalk server software that provides AFP file‑sharing for macOS clients. No other vendors or products are listed as affected.

The CVSS score of 5.9 indicates moderate severity. No EPSS data is available, so the likelihood of exploitation remains uncertain, although the presence of a timing side channel suggests realistic risk for attackers with network access. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed public exploits exist. Attacks would require connectivity to the Netatalk service and the ability to measure response times accurately; attackers would typically target the service over the network interface, which is the inferred attack vector based on the nature of the service.