This vulnerability arises when Syslink Software AG Avantra uses default usernames and passwords for its internal database on Linux and Windows. The flaw permits attackers to acquire credentials through a trial of common or default login pairs, potentially leading to unauthorized access to sensitive data. The weakness is categorized under CWE‑1393, indicating use of default or hidden credentials that compromise confidentiality and integrity.

The affected product is Avantra from Syslink Software AG, with all versions prior to 25.3.0 susceptible to the issue. The vulnerability applies to installations running on Linux or Windows operating systems.

The CVSS score of 5.1 reflects a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Based on the description, the likely attack vector is external access to the database service where default credentials are accepted; an attacker able to reach the database endpoint could credential‑guess or brute‑force default accounts to read or modify data. The exploitation requires network connectivity to the database but does not need local system privileges.