IRISPowerscan has an insecure default configuration that assigns elevated privileges to a built‑in installation account and the password for that account is predictable. An unauthenticated attacker could exploit this to gain unauthorized access to privileged application functionality, potentially compromising confidentiality and integrity of the system.

The affected product is IRISPowerscan from I.R.I.S S.A. No specific version information is disclosed in the advisory. The vulnerability arises from the default privileged installation account rather than a particular software build.

This vulnerability carries a CVSS score of 7.2, indicating a high potential impact. While an explicit EPSS score is not provided, the presence of a predictable default password makes exploitation relatively straightforward for an attacker who can reach the installation account. The issue is not listed in the CISA KEV catalog, but the ease of exploitation and the privilege escalation risk warrant immediate remediation. An attacker could use the default credentials to perform privileged operations within the application, leading to potential system compromise or data exposure.