The vulnerability in GPM LIGHT allows unauthenticated remote attackers to retrieve system logs directly. This access reveals sensitive information stored in logs, potentially exposing configuration details, user credentials, or other confidential data. The weakness, classified as CWE-497, underscores that private data is inadequately protected from unauthenticated access.

The affected product is ezGlobal’s GPM LIGHT. No specific version information is provided in the advisory, so all deployed instances of GPM LIGHT are potentially vulnerable until remediation is applied.

The CVSS score of 6.9 indicates moderate risk. Because the EPSS score is not available, the precise likelihood of exploitation remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and does not require authentication, allowing attackers to send a request to the exposed endpoint and receive logs. Once the logs are accessed, the attacker obtains sensitive information that could compromise system confidentiality and provide footholds for deeper attacks.