EUVD-2026-28989
GHSA-93h2-436q-pcqf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the component RMI Interface. Such manipulation leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers to obtain sensitive information via the iasGetServerInfoEvent function in the RMI Interface. The vulnerability has a publicly available exploit and CVSS score of 5.3 (medium severity) with confidentiality impact but no integrity or availability impact. The vendor did not respond to early disclosure.
Technical ContextAI
The vulnerability exists in the Remote Method Invocation (RMI) Interface component of Canias ERP, specifically within the iasGetServerInfoEvent function. RMI is a Java mechanism for remote object invocation that allows calling methods on objects in different JVMs, often across network boundaries. The root cause is classified as CWE-285 (Improper Authorization), indicating that the iasGetServerInfoEvent function fails to properly validate caller privileges before returning server information. This allows an unauthenticated network attacker to invoke the function and retrieve sensitive details that should be restricted to authorized administrators or internal processes. The attack vector is network-based with low complexity, meaning the exploit does not require special network conditions or multiple attack steps.
RemediationAI
No vendor-released patch has been identified at time of analysis, as Industrial Application Software IAS did not respond to early disclosure. Immediate mitigation requires restricting network access to the RMI Interface component: implement network-level access controls (firewall rules) to block RMI port traffic (typically 1099 or application-specific ports) from untrusted networks, limiting exposure to internal networks only. Alternatively, disable or remove the RMI Interface if not required for operational functionality. Monitor for calls to the iasGetServerInfoEvent function and alert on any unauthenticated invocations. If upgrade to a patched Canias ERP release becomes available after vendor response, apply it immediately. Organizations unable to restrict network access should consider isolating Canias ERP systems behind a VPN or internal-only network perimeter. Verify via vendor contact (or community sources) whether a newer version exists that addresses this authorization bypass.
More in Canias Erp
View allImproper authentication in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers t
Information disclosure in Industrial Application Software IAS Canias ERP 8.03 allows remote attackers to extract sensiti
OS command injection via Runtime.getRuntime.exec in Canias ERP 8.03 RMI Interface allows authenticated remote attackers
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today