The flaw in IXP Manager allows an authenticated user who is not an administrator to gain administrator privileges by exploiting improper input validation or misconfigured access control, as indicated by the CWE entries. This results in full administrative control over the exchange point, enabling unauthorized configuration changes, route manipulation, and the potential to disrupt services for all connected networks, thereby compromising confidentiality, integrity, and availability.

All installations of IXP Manager earlier than version 7.3.0 are vulnerable, as the issue is fixed only in release 7.3.0. The vendor identified by the CNA is inex for the product IXP-Manager.

The vulnerability has a CVSS score of 8.8, classifying it as high severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires valid user credentials; an attacker can use the web interface to trigger the privilege escalation. Because any authenticated session can be abused, the risk remains significant until the patch is applied.