A critical authentication bypass is present in the Gigatech PDV5701 WebSocket Service, allowing remote manipulation of the /index.html file without requiring credentials. The vulnerability is caused by a missing authentication mechanism in that component, which can lead to unauthorized access to the device and potentially allow an attacker to run commands or exfiltrate data through the WebSocket interface. The weakness is classified under CWE-287 and CWE-306, indicating both an authentication failure and a missing authentication policy.

The affected product is Gigatech PDV5701, specifically version 1.0.31_240305_112640. No other versions are listed in the CNA data, but the vulnerability description suggests that any build containing the same WebSocket Service component may be susceptible.

The CVSS score of 10 assigns the highest severity to this issue, and the exploit has already been made public, indicating that remote actors can target the service over the network. While the EPSS score is not available, the lack of a KEV listing does not mitigate the fact that the flaw significantly reduces confidentiality and integrity by permitting unauthenticated control. The likely attack vector is a remote network connection to the WebSocket Service endpoint, and because the flaw lies within a component exposed to external traffic, the risk to any deployed device is high until a fix or mitigation is applied.