Technical impact
The vulnerability resides in the Remote Administration Daemon component of Oracle Solaris 11.4. An unauthenticated attacker who can send HTTPS requests to the daemon can exploit the flaw to compromise the system, enabling unauthorized creation, deletion, or modification of critical data and full access to all data accessible by the Solaris instance. The flaw effectively provides remote code execution or privilege escalation that changes scope, resulting in complete confidentiality and integrity compromise while availability is not directly affected.
Affected Systems
Only Oracle Solaris 11.4 is affected, specifically the Remote Administration Daemon component. No other versions or products were identified as vulnerable according to the current advisory.
Risk and Exploitability
The CVSS base score of 10.0 indicates maximum severity, with Confidentiality and Integrity both at high impact and a scope change. The EPSS score is listed as < 1%, suggesting current exploit likelihood is low, and the vulnerability is not yet listed in CISA KEV. Nevertheless, the high severity and potential for full system compromise mean that immediate action is recommended. The attack vector is an unauthenticated HTTPS connection to the vulnerable service, implying that an attacker must be able to reach the RDA port over the network.
