A flaw was detected in the 2025.3.20 release of BichitroGan ISP Billing Software affecting the Endpoint component’s users‑view route. By manipulating the ID argument, an attacker can cause improper control of resource identifiers, enabling remote resource injection. The public exploit demonstrates that the weakness can be leveraged from outside the network, potentially allowing unauthorized access to or modification of billing or user data.

This vulnerability applies only to the BichitroGan ISP Billing Software version 2025.3.20. No later, patched release is documented, so all installations of this specific version remain vulnerable.

With a CVSS score of 5.3 the risk is moderate, yet the attack can reach end‑points remotely and the exploit is publicly available. Although EPSS data is missing and the issue is not listed in CISA’s KEV catalog, the lack of a vendor response underscores the potential for unmitigated exposure if no interim controls are applied.