The vulnerability exists in Cryptobox's external sharing feature, allowing an attacker who knows a sharing link URL to obtain server-side information that can be used to perform an offline brute-force attack against the access code that protects the shared content. This flaw permits unauthorized reading or copying of data that was intended to remain confidential to the designated recipients. The weakness is an information-exposure flaw (CWE‑280) where access code protection is inadequate.

The product affected is Ercom Cryptobox. No specific version numbers were supplied in the CNA data.

Reported CVSS score of 6.9 indicates a medium-to-high risk. The EPSS score of less than 1% shows a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to obtain a valid external sharing link URL; once the URL is in hand, the server leaks information that facilitates an offline brute-force attack against the access code. Success would expose the confidential data shared via the link. The drawback of a low EPSS suggests that exploitation may be opportunistic rather than widespread, but the potential confidentiality impact remains significant.