The vulnerability is a classic SQL injection flaw in Crocus version 1.3.44, located in the DeviceInfoMapper.xml configuration file. A remote attacker can inject arbitrary SQL statements, potentially reading sensitive data, modifying configuration, and escalating privileges on the device. This flaw directly maps to CWE-89. The impact is the ability to gain elevated privileges on the targeted system, leading to compromise of confidentiality, integrity, and availability.

This flaw exists in Crocus software 1.3.44. No other versions are explicitly listed as affected. The issue is tied to the DeviceInfoMapper.xml file used by the device's web interface, implying that any implementations of Crocus version 1.3.44 that expose this endpoint are vulnerable.

The CVSS score of 9.8 indicates a critical severity, but the EPSS score of less than 1% suggests that, at the time of analysis, exploitation attempts were very rare. The vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is remote over the network, as the defect resides in a web‑accessible XML configuration endpoint. Exploitability depends on network exposure and authentication; the feed does not specify authentication requirements, so a remote unauthenticated attacker is assumed.