MeWare Software Development Inc.'s PDKS has a vulnerability that allows an unauthorized actor to access sensitive personal information exposed by the application. The weakness is identified as CWE-200 and CWE-359, indicating that information is being inadvertently exposed. This disclosure can compromise the confidentiality of private data, potentially enabling identity theft or other privacy violations. The description does not detail the attack vector, but it implies that the vulnerable component can be accessed by users without proper authorization.

The affected product is MeWare Software Development Inc.’s PDKS. Versions ranging from V16.20200313 up to, but not including, VMYR_3.5.2025117 are impacted. Users deploying any of these releases should verify their version against this range.

This vulnerability carries a CVSS score of 6.5, placing it in the medium severity range. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that publicly available exploits are currently unknown. Without a defined attack vector, the likelihood of exploitation is uncertain, but the medium severity and potential confidentiality impact warrant prompt attention.