The vulnerability arises from a hard‑coded database superuser password set during Armatura One’s initialization. When a deployment has not changed this value, anyone who gains operating‑system access can log in to the database with full privileges, enabling tampering with data, configuration, or the entire application. This grants an attacker control over confidentiality, integrity, and availability of the system’s data.

Vulnerable versions include Armatura One V4.7.1 and earlier on the universal line, and V4.3.1_USA and earlier on the USA release line. Any installation of those versions that has not been updated to the respective patch releases remains at risk.

The CVSS score of 8.6 reflects a high severity with local access as the reported attack path, as the issue requires an attacker to have operating‑system privileges. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. However, because the flaw provides direct superuser credentials, a local attacker could achieve full database compromise if the system is not otherwise fenced. The attack vector is thus inferred to be local, and the exploitation risk is significant for systems that expose the database to privileged users.