An improper privilege management flaw in Genian SSL PNS enables an attacker who can submit a CSV bulk user registration file to assign super administrator permissions and trigger the creation of an operating‑system account. The flaw allows the attacker to bypass normal role checks, elevate privileges, and potentially gain full control over the application and underlying system. The weakness is classified as CWE‑269, reflecting the mismanagement of permission levels.

The vulnerability affects both the frodo-core and watchcat‑ui components of Genian SSL PNS. All installations of these modules running a release earlier than 5.0.0 are susceptible because the recommended fix requires upgrading to 5.0.0. The advisory lists Genians, Inc Genian SSL PNS (frodo-core) and Genians, Inc Genian SSL PNS (watchcat‑ui) as the impacted products.

With a CVSS score of 7.5 the risk is considered medium‑to‑high. Exploitation probability is not quantified but the attack would involve crafting a CSV file and submitting it through the bulk import interface, a path that is readily available to users with upload access. Since the vulnerability is not yet in the CISA KEV catalog, no publicly known exploits are confirmed, but the lack of mitigation in older releases means that an actor with local or remote access to the bulk import endpoint can execute the privilege escalation without additional prerequisites.