Trapdoor
Monthly
Improper access control in 3CORESec Trapdoor versions up to and including 1.2.2 allows remote low-privileged attackers to bypass authorization logic via the DefaultFunction handler, yielding limited but real confidentiality, integrity, and availability impacts on the vulnerable system. The 'Authentication Bypass' tag and CWE-284 classification together indicate that the DefaultFunction fails to enforce expected access restrictions, a particularly concerning pattern for a product category whose core purpose is access gating. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 4.0 score of 5.3 (Medium) reflects low-tier CIA impacts constrained to the vulnerable system itself with no lateral scope change.
Improper access control in 3CORESec Trapdoor versions up to and including 1.2.2 allows remote low-privileged attackers to bypass authorization logic via the DefaultFunction handler, yielding limited but real confidentiality, integrity, and availability impacts on the vulnerable system. The 'Authentication Bypass' tag and CWE-284 classification together indicate that the DefaultFunction fails to enforce expected access restrictions, a particularly concerning pattern for a product category whose core purpose is access gating. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 4.0 score of 5.3 (Medium) reflects low-tier CIA impacts constrained to the vulnerable system itself with no lateral scope change.