It involves an improper access control flaw in an unknown function of the UPF component within Dotouch XproUPF. The vulnerability allows a manipulated input to bypass intended permission boundaries, potentially granting an attacker unauthorized access to protected resources or configuration data. The weakness corresponds to authorization bypass (CWE‑266) and general improper access control (CWE‑284).

Only the 2.0.0-release‑088aa7c4 build of Dotouch XproUPF is listed as affected. No other vendor versions are documented. The flaw resides in the UPF module, which is part of the network processing stack; therefore the impact is confined to systems running that specific build.

The CVSS score of 2.1 signals low severity, and no EPSS value is available, indicating limited known exploitation activity. The description notes high attack complexity and that exploitability is difficult. Whereas the exact attack vector is not supplied, it is reasonable to infer that the flaw would be exploited through remote or local manipulation of the UPF component’s management interface, requiring privileged access to the affected function. The flaw is not listed in the CISA KEV catalog, further suggesting the risk of widespread compromise is low, but the presence of improper access controls remains a concern for systems relying on strict privilege separation.