The vulnerability resides in the doAction method of the RMI interface in IAS Canias ERP 8.03. An attacker can manipulate the sessionId argument to bypass authentication checks, thereby obtaining unauthorized access to the system. This flaw is classified as an authentication bypass and can lead to the compromise of confidentiality and integrity of the application, potentially allowing an attacker to perform any operation as an authenticated user. The nature of the weakness (CWE-287) indicates that the issue stems from faulty implementation of access controls rather than a buffer overflow or code injection.

The affected product is Industrial Application Software IAS:Canias ERP, specifically version 8.03. No other versions or vendor products are listed.

The CVSS score of 6.9 reflects a moderate severity, while the EPSS score is listed as not available, so the exploitation probability cannot be quantified from the data. The flaw has not been reported in the CISA KEV catalog. Attackers can exploit this remotely through the RMI endpoint, as the description indicates that the attack can be launched from a remote location. Because the vendor has not released a patch or publicly noted a workaround, the risk remains until remedial action is taken.