Outdated third-party UI dependencies in BLU-IC2 and BLU-IC4 firmware through 1.19.5 can expose the management web interface to remote, unauthenticated exploitation, primarily risking information disclosure with lower integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.41% (34th percentile). Real-world exposure is limited by reachability of the device UI, since these access-control appliances are often segmented onto internal or restricted networks.
Authenticated Gallagher Command Centre Server operators holding only limited site permissions can abuse the Morpho integration to make critical configuration changes to local Morpho biometric devices, effectively exceeding their authorized site scope. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the scope change lets a low-privileged account act beyond its intended security boundary, but exploitation requires a valid operator account and a deployment that actually has the Morpho integration configured - Command Centre installations without Morpho hardware are not exposed. Only 0.34% EPSS and no CISA KEV entry indicate low observed exploitation activity, and no public exploit code has been identified at time of analysis; the main risk is insider or compromised-credential abuse in Morpho-enabled environments.
Server-side request forgery in Microsoft's cloud-hosted Azure Compute Gallery allows unauthenticated remote attackers to coerce the Azure Compute Resource Provider into issuing attacker-influenced requests, ultimately elevating privileges within the service. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), exploitation is network-reachable, low complexity, requires no authentication and no user interaction, and yields high confidentiality and integrity impact; the scope is unchanged. There is confirmed no public exploit code and no CISA KEV listing at time of analysis - no public exploit identified at time of analysis - and the EPSS score is modest at 0.77% (54th percentile), reflecting that the primary constraint is operational: the target is a Microsoft-operated multi-tenant service remediated centrally by Microsoft, not by customer patch deployment.
Azure Event Grid, Microsoft's fully managed event-routing service, can be abused by unauthenticated remote attackers to elevate privileges with high impact across confidentiality, integrity, and availability, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no credentials or user interaction are required and attack complexity is low. The root cause is improper access control (CWE-284) in the service's own authorization logic; because Event Grid is a multi-tenant cloud PaaS, any fix is applied centrally by Microsoft rather than by customers, which substantially narrows the real-world exposure window. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.38% (30th percentile), so the 9.8 base score overstates near-term exploitation likelihood; an independent assessment confirms the primary limiting factor is the cloud-managed deployment model, and the exact starting trust level implied by 'elevate privileges' remains ambiguous in the available data.
Remote file inclusion in ArkSigner AcBakImzala versions before 5.1.4 allows unauthenticated attackers to coerce the PHP application into including attacker-controlled files, resulting in local file inclusion and potential remote code execution. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Authenticated remote command execution affects the Veeder-Root TLS4B Automatic Tank Gauge (ATG), whose SOAP-based web services handler exposes functionality that allows an attacker with valid credentials on that interface to run system-level commands on the device's underlying Linux operating system. Successful exploitation yields full shell access on the gauge and a foothold for lateral movement into the surrounding OT/fuel-management network. Per the CVSS vector the attack requires network reachability plus valid credentials (PR:L), not pre-auth access, and no user interaction; there is no CISA KEV listing and no public exploit code identified at time of analysis, while EPSS sits at 1.39% (71st percentile) - a moderate, not extreme, likelihood signal. Severity is nevertheless very high (CVSS 9.4 per the 4.0 vector; independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because a single compromised credential converts directly into host-level control of a safety- and business-critical tank monitoring device.
Unauthenticated file read, write, and deletion in AutomationDirect Productivity Suite 4.4.1.19 arises because the ProductivityService PLC simulator binds to an unrestricted IP address and does not require credentials or user interaction. Any network-reachable attacker can invoke file operations to read, write, or delete arbitrary files and folders under the service's permissions, although realistic exposure depends on whether the OT engineering workstation or simulator is reachable from untrusted segments. No public exploit was identified at time of analysis, and EPSS is low at 0.66% (51st percentile), but the potential impact is severe where the service is exposed.