The vulnerability allows an attacker to bypass the local connection check in Remote Spark SparkView prior to build 1122 and execute arbitrary code with root privileges on the host. Depending on the configuration, the flaw can be exploited by an unauthenticated attacker, giving attacker unrestricted control.

This issue affects Remote Spark's SparkView component on versions earlier than build 1122. The product is available from Remote Spark.

The CVSS score of 10 indicates critical severity. EPSS is not available and the vulnerability is not listed in CISA KEV, but the high severity coupled with the ability to achieve root execution suggests a high exploitation likelihood, especially if the application is exposed to external traffic. An attacker could simply access the gateway and trigger the bypass, resulting in complete compromise of the underlying system.