The vulnerability in dromara orion-visor up to version 2.5.7 is due to the use of a hard-coded cryptographic key in the HostKeyServiceImpl.encryptKey method within the orion-visor-module-asset-service component. This cryptographic weakness can be exploited remotely. The vulnerability has a CVSS 3.1 score of 8.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. The vulnerability was reported early but remains unpatched and publicly disclosed.

Exploitation of this vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to the use of a hard-coded cryptographic key. Remote attackers can exploit this without authentication or user interaction, increasing the risk of unauthorized access or manipulation of sensitive data.

No official fix or patch is currently available as the project has not responded to the issue report. Users should monitor the vendor's communications for updates and consider mitigating risk by restricting network access to the affected service until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.