The vulnerability exists in Cryptobox's external sharing feature, allowing an attacker who knows a sharing link URL to obtain server-side information that can be used to perform an offline brute-force attack against the access code that protects the shared content. This flaw permits unauthorized reading or copying of data that was intended to remain confidential to the designated recipients, aligning with CWE‑280’s description of insecure private credential storage or leakage.

The product affected is Ercom Cryptobox. No specific version numbers were supplied in the CNA data.

The reported CVSS score of 6.9 indicates a medium to high level of risk, and the CVE is not yet listed in the CISA KEV catalog. Because the flaw requires knowledge of a sharing link URL, an attacker typically must acquire the URL through legitimate or deceptive means; once the URL is in hand, the server does not protect the access code, allowing the attacker to conduct an offline brute‑force attempt. If successful, the attacker can obtain the confidential data shared via the link, meaning a moderate likelihood of exploitation combined with significant confidentiality impact. The absence of a public EPSS score suggests that, at present, the exploitability might not be widely observed, but the potential to compromise sensitive information remains.