The vulnerability allows an attacker who knows the location of files on the Panorama Web HMI server host to read those files if the Servin process execution account has permission to do so. This grants unauthorized disclosure of potentially sensitive data and occurs through the web interface captured by the vulnerability. The weakness aligns with CWE‑552, representing improper access control that permits reading files the user should not access.

Panorama Suite from CODRA is affected. Installations based on Panorama Suite 2022‑SP1 (22.50.005) are vulnerable unless the update PS‑2210‑02‑4079 or newer is installed. Installations based on Panorama Suite 2023 (23.00.004) are vulnerable unless updates PS‑2300‑03‑3078, PS‑2300‑04‑3078, and PS‑2300‑82‑3078 or newer are installed. Installations based on Panorama Suite 2025 (25.00.016) are vulnerable unless updates PS‑2500‑02‑1078 and PS‑2500‑04‑1078 or newer are installed. Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are vulnerable unless updates PS‑2510‑02‑1077 and PS‑2510‑04‑1077 or newer are installed.

The CVSS score of 7.7 indicates high severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the Panorama Web HMI interface, where an adversary who can identify file paths may read files that the Servin process can access. Because the vulnerability relies on the Servin process permissions, it can be exploited remotely through authenticated or unauthenticated access to the web interface, and no further conditions are required beyond knowledge of accessible paths.