Technical impact
Based on the description, it is inferred that Oracle Enterprise Command Center Framework’s core component contains a vulnerability that is easily exploitable by an attacker with network access over HTTP. The flaw arises from missing authentication and authorization controls, improper privilege escalation, and insecure local privilege escalation (CWE‑284 and CWE‑269). An attacker with low privilege can compromise the framework, and due to the scope change, additional products that rely on the framework may also be impacted. Successful exploitation results in full takeover of the affected instance, providing control over all data and functions of the framework.
Affected Systems
The vulnerability affects Oracle Corporation’s Oracle Enterprise Command Center Framework, specifically versions 15 and 16. Users running these releases are at risk.
Risk and Exploitability
The CVSS v3.1 base score of 9.9 indicates a critical threat with Confidentiality, Integrity and Availability impacts, and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C reflects that a network attacker with low privilege can change the vulnerability’s scope. Although the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, the high severity score and the potential for complete takeover warrant immediate attention.
