The vulnerability originates from default user accounts with predictable credentials that are preconfigured in IRISPowerscan. Because these credentials are known, an unauthenticated attacker can log in and gain access to functionality that the affected accounts provide. This can lead to unauthorized viewing, alteration, or deletion of application data and configuration settings. The weakness is characterized as a predictable credential flaw, mapped to CWE-1392.

The affected product is I.R.I.S S.A. IRISPowerscan. No specific version information is provided in the available data.

The CVSS score of 7.2 indicates moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation but still possible in environments where the application is exposed. The attack vector is inferred to be local or network-based, requiring an attacker to have network reach to the application instance before using the predictable credentials to authenticate.