Vitals ESP EUVD-2025-201692

Exploitation requires an authenticated session with high privileges (CVSS PR:H) on a Vitals ESP instance (versions 0 through 6.3), meaning the attacker must already be an administrative/privileged user or control such an account. Given that prerequisite, no user interaction is needed (UI:N) and the request can be delivered over the network (AV:N) with low complexity (AC:L), using an absolute file path to the affected download/file-retrieval feature to read arbitrary system files. The primary limiting factor is the high-privilege authentication gate; impact is restricted to confidentiality (file disclosure) with no integrity or availability effect.

This is a medium-severity, privilege-gated information-disclosure flaw rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) shows a network-reachable, low-complexity attack but one that explicitly requires high privileges (PR:H), and impact is confined to confidentiality (VC:H, with VI:N/VA:N) - consistent with an arbitrary file read. Multiple signals agree on 'elevated but not critical': the 6.9 base score, the PR:H gate, and a very low EPSS of 0.07% (22nd percentile) all point to limited mass-exploitation likelihood. There is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' The description's phrase 'privileged remote attackers' aligns cleanly with the CVSS PR:H metric, so there is no conflict between the narrative and the vector. The main residual risk is an already-authenticated/high-privileged user or a compromised admin account escalating to read sensitive files (credentials, config, keys) outside the application's intended scope. Net: real but secondary priority - patch in normal cycles unless the product is internet-exposed with weak admin credential hygiene.

An attacker who already holds a privileged (administrative) account on a Vitals ESP instance - obtained via phished or reused credentials - sends a crafted request supplying an absolute filesystem path to the vulnerable download function. The server returns the targeted file, letting the attacker read sensitive system files such as configuration, credential stores, or private keys. No public exploit code is identified, and the required high-privilege authentication (PR:H) meaningfully limits who can perform this.