The vulnerability arises from the Redis authentication mechanism in NoMachine, where insufficient entropy in credential generation allows a local attacker to bypass authentication. When exploited, the attacker can obtain service account privileges and execute arbitrary code in that context. The weakness is a clear local privilege escalation without requiring network access. The flaw stems from the of weak random values, identified as CWE‑331.

The affected product is NoMachine, as specified by the CNA. No specific version range is listed, so any installation that uses the default Redis authentication may be vulnerable.

The CVSS score of 7.8 indicates a high severity event. EPSS data is not available, so the current exploitation likelihood is unknown, but the absence of a KEV listing suggests no widespread or active exploitation has been reported. The attacker must first achieve local code execution; this restricts the attack surface to systems where the attacker has low‑privilege access. Once that pre‑condition is met, the easy escalation path means a high impact if the vulnerability is leveraged.