The vulnerability is a CORS misconfiguration in the coolercontrold service that allows unauthenticated attackers to bypass same‑origin restrictions. This flaw, classified as CWE‑942, enables malicious web pages to read sensitive data returned by the service and to issue commands to it, effectively granting remote control over the device.

CoolerControl’s coolercontrold component, specifically all releases before version 4.0.0, is affected. The advisory applies to the current 2.0.0 codebase referenced in the source repository.

The CVSS score of 6.3 indicates a moderate threat level. No EPSS score is available and the issue is not listed in KEV, suggesting limited public exploitation data. The likely attack vector is through a web browser that visits a malicious site, leveraging the permissive cross‑domain policy to interact with the service. Exploitation requires no special privileges or authentication, so the risk to exposed systems is significant.