The vulnerability allows an attacker who is not authenticated to modify the server’s configuration file in DRC Central Office Services (COS). This flaw can enable mass data exfiltration, interception of malicious traffic, or disruption of testing services. The flaw represents a weakness in access control, equivalent to an improper authorization issue that undermines confidentiality and integrity of the system’s configuration.

Data Recognition Corporation’s Central Office Services – Content Hosting Component. No specific version information is provided, so any installation of this component is potentially impacted.

The vulnerability is likely exploitable via network channels that grant write access to configuration files, given the lack of authentication requirements. With an EPSS score of less than 1% and no listing in CISA’s KEV catalog, the exact exploit probability is low but non-zero; however, the absence of authentication suggests a significant risk if left unmitigated. A CVSS score of 7.5 indicates high severity. Potential attackers could alter service parameters, potentially redirect traffic or exfiltrate data, making this a high‑impact vulnerability if exploited.