N A CVE-2026-31151

Remote unauthenticated attacker can exploit the login bypass vulnerability in Kaleris YMS v7.2.2.1 without requiring user interaction, authentication credentials, or special network configuration. No specific feature enabling required—default installations are vulnerable.

This vulnerability presents critical real-world risk despite moderate EPSS scoring. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates maximum exploitability: network-accessible, low attack complexity, requiring no privileges or user interaction. The complete CIA triad impact (C:H/I:H/A:H) means attackers gain full system access equivalent to legitimate users. While EPSS at 2% (5th percentile) suggests low observed exploitation probability in current scanning data, this contradicts the vulnerability's technical severity and the existence of public exploit code on GitHub. The presence of a documented POC significantly lowers the barrier to exploitation. SSVC factors indicate high priority: publicly available exploit code exists, the flaw appears automatable given network access without authentication, and technical impact is total system compromise. The discrepancy between high CVSS/exploit availability and low EPSS likely reflects limited YMS deployment visibility in public scanning datasets rather than genuine low risk. For organizations running Kaleris YMS 7.2.2.1, this should be treated as a critical emergency patch priority regardless of EPSS, as authentication bypasses in enterprise logistics systems can enable supply chain disruption, data theft, and operational sabotage.

An external attacker identifies a Kaleris YMS 7.2.2.1 instance exposed to the internet through reconnaissance scanning. Using the publicly available exploit code from the GitHub repository, the attacker crafts requests that bypass the login verification mechanism entirely, gaining immediate authenticated access to the YMS application without providing valid credentials. Once inside, the attacker can manipulate yard schedules to disrupt logistics operations, access sensitive supply chain data including shipment details and customer information, modify dock assignments to create operational chaos, or escalate privileges to gain deeper system access for persistent backdoor installation or lateral movement into connected enterprise resource planning systems.