The vulnerability resides in FOGProject’s FOGPage component, where the clearAES and clearPMTasks methods can be called without authentication, session validation, or CSRF protection. The methods are exposed through the public client node endpoint and can be invoked with a single HTTP GET request. Prior to versions 1.5.10.1832 and 1.6.0‑beta.2313 an attacker can wipe a host’s AES encryption credentials and delete all scheduled power‑management tasks. This effectively destroys the key needed to decrypt data stored on that host and removes automated power‑management operations such as shutdown, reboot, and power cycling. These effects create loss of data confidentiality and loss of operational control, reflecting the missing authorization weakness identified by CWE‑862.

The affected product is FOGProject’s FOG imaging and cloning application. Versions prior to 1.5.10.1832 and 1.6.0‑beta.2313 are vulnerable. The security fix was introduced in the 1.5.10.1832 and 1.6.0‑beta.2313 releases.

The CVSS score of 8.2 indicates a high‑severity flaw, largely due to the lack of authentication and the potential for irreversible data loss. The EPSS score of less than 1 % suggests a very low likelihood of exploitation today, but the flaw can be exercised from any network that can reach the client node endpoint, making it straightforward for an attacker if the endpoint is publicly reachable. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need only network access to the vulnerable endpoint and can exploit the flaw immediately, which underlines the urgency of applying the vendor patch.