The flaw arises because the application does not adequately limit the execution of scripts supplied by users. An authenticated user who can import or modify scripts is able to embed malicious code that the system will execute in the environment of the Windows account running IRISPowerscan, thereby allowing arbitrary code execution within that user’s security context. This weakness is classified as CWE‑829, insufficient restriction of untrusted scripts, and could enable an attacker to compromise the machine or gain elevated privileges if the Windows user is an administrator.

The product affected is IRISPowerscan from I.R.I.S S.A. No specific version range is indicated in the advisory, so all deployments of this application that support script import or modification functionality are considered at risk.

The CVSS score of 6.1 indicates a medium severity vulnerability, but because the attack requires authenticated access to the script feature, the risk depends on the strength of user credentials and internal access controls. The EPSS score is not provided, and the issue is not listed in CISA's KEV catalog, so there is currently no evidence of widespread exploitation. However, once credentials are obtained, the attacker can execute arbitrary code. Consequently, the overall risk remains moderate to high for environments where IRISPowerscan runs on Windows user accounts with elevated privileges.