GREENmod uses named pipes for communication between plugins, the web portal, and the system service. The access control lists for these pipes are incorrectly configured, allowing an attacker to send arbitrary XML or JSON data through the pipe. The data is then processed with the privileges of the user under whose context the service runs, giving the attacker the ability to perform server‑side request forgery to any Windows system on which the agent is installed and which offers SMB or WebDAV interfaces.

Nomios Poland provides the GREENmod product. Versions prior to 2.8.33 are affected; the issue was fixed in version 2.8.33.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the probability of exploitation is unknown; the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector involves an attacker interacting with the web portal or a plugin to send data to the misconfigured pipe, after which the agent can contact internal or external Windows systems via SMB or WebDAV. If exploited, the attacker could propagate to internal network resources and potentially achieve further privilege escalation.