The vulnerability is an access control deficiency within NEC Corporation's ExpressUpdate Agent for Windows. It allows an attacker who can reach the agent to execute arbitrary code as the SYSTEM account. This flaw can compromise confidentiality, integrity, and availability of the affected machine by granting full administrative control and the ability to install malware or exfiltrate data.

The issue affects the ExpressUpdate Agent for Windows supplied by NEC Corporation. No specific product versions are listed in the official advisory, so all installations of the agent are potentially vulnerable until a patch is applied.

The CVSS score is 8.5, indicating a high severity. EPSS is not available, and the vulnerability is not yet listed in CISA's KEV. The likely attack vector is local: an attacker who gains any form of access to the machine or the agent service can exploit the flaw. Because the consequences are full SYSTEM privilege, the risk is significant for any user with administrative or local access rights.