The vulnerability is found in Industrial Application Software IAS Canias ERP 8.03, within the Java RMI Session Management component. The iasServerRemoteInterface.doAction method does not enforce proper authentication, allowing an attacker to traverse session boundaries. A remote attacker could impersonate a legitimate user or initiate actions on the system, compromising confidentiality and integrity of business data. The weakness is a classic authentication bypass, corresponding to CWE-287.

Affected is the Canias ERP 8.03 version of Industrial Application Software IAS. No other versions or configurations are mentioned. The functionality affected is the remote interface used for session management via Java RMI.

The CVSS base score of 6.9 indicates a moderate severity level. No EPSS figure is available and the vulnerability is not in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack is remote, requiring the attacker to reach the Java RMI endpoint. Because the flaw is an authentication bypass, an attacker that can reach the endpoint can potentially gain unauthorized access without additional privileges. Systems with publicly exposed RMI interfaces are at higher risk.