ARKETEAM Protectel EUVD-2025-211224

Requires an authenticated low-privileged account within the ARKETEAM Protectel application (CVSS PR:L) and adjacent-network reachability to the service (AV:A) - it is not exploitable by a fully unauthenticated, arbitrary internet attacker. Given that foothold, the attacker forges a direct request to a specific endpoint that is reserved for administrators; the application does not enforce authorization on that endpoint (CWE-863), granting access to admin-only functionality with no user interaction (UI:N) and low attack complexity (AC:L). Limiting factors: valid low-privileged credentials must already exist, access is adjacent rather than remote-internet, and impact is partial (VC:L/VI:L/VA:L). The affected modules are PROTECTELMAJ before v6.5.19 and BDF before v6.4.67; applying those vendor-released versions is the fix. The exact vulnerable endpoint is not named in the available sources.

This is a genuine but moderate-priority issue, not a drop-everything emergency, and the signals are internally consistent. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N) shows an authenticated, low-privileged attacker on an adjacent network can reliably trigger the flaw with no user interaction, but impact is limited (VC:L/VI:L/VA:L, no subsequent-system impact), yielding a Medium 5.1 score consistent with CWE-863 (incorrect authorization). The vuln.today decision label is 'this_month' rather than act_now/emergency, which matches the absence of exploitation signals: there is no CISA KEV listing, no EPSS probability supplied, and no public exploit identified at time of analysis. The practical gating factor is the PR:L requirement - an attacker must already hold a valid low-privileged account on the Protectel deployment - plus adjacent (not fully remote-internet) access, so this is primarily an insider / post-foothold privilege-escalation risk rather than a mass-exploitable internet-facing bug. No conflicting signals are present, but note that EPSS and KEV data are simply absent (not low), so exploitation likelihood cannot be quantified from the input.

A user who has been granted only a low-privileged account in the Protectel application (PROTECTELMAJ or BDF) crafts and sends a direct HTTP request to an endpoint that is supposed to be restricted to administrators. Because the application fails to re-check authorization on that endpoint, the request succeeds and the attacker invokes admin-reserved functionality. No public exploit code is identified at time of analysis; exploitation requires an existing low-privileged session and adjacent-network reachability.