A flaw in the iasGetServerInfoEvent function of the RMI interface allows an attacker to perform actions without proper authorization, thereby enabling remote exploitation. The vulnerability arises from improper authorization controls, exposing the system to unauthorized access and potentially compromising both data confidentiality and integrity. It is a significant weakness that could be exploited to gain privileged access to the ERP system.

Industrial Application Software IAS Canias ERP version 8.03 is affected. The flaw exists within the RMI component that handles server information events. No other products or versions are listed as impacted.

The CVSS score of 6.9 indicates a medium severity impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The likely attack vector is remote access to the RMI service, with an attacker potentially sending crafted requests to invoke the vulnerable function. The exploit is publicly disclosed, and the vendor has not responded to the disclosure, implying the risk remains unmitigated until a patch is issued.