Industrial Application Software IAS Canias ERP 8.03 contains a flaw in the Login RMI Interface’s doAction method. When an attacker sends a specially crafted request, the server returns a response that differs from the expected pattern. Based on the description, it is inferred that this observable discrepancy may allow attackers to infer details about the system’s internal state or bypass authentication flows, potentially constituting an information‑disclosure vulnerability. The flaw relies on manipulating data exchanged over the RMI interface and is reported as requiring high complexity and skill to exploit.

The vulnerability exists in all installations of Industrial Application Software IAS Canias ERP version 8.03. No other product versions have been explicitly listed as affected. Operators should verify the ERP version and confirm whether their instance matches the 8.03 release to determine exposure.

The CVSS score of 6.3 indicates moderate severity, yet the exploit is described as difficult, with remote access required. EPSS is unavailable, so the probability of exploitation cannot be quantified. The flaw is not cataloged in CISA’s KEV list, but a public proof‑of‑concept has been published, meaning motivated attackers could target exposed RMI interfaces to obtain sensitive information.