This vulnerability (CVE-2024-0336) in EMTA Grup PDKS version 3.04 before 2024-06-03 is categorized as CWE-306: Missing Authentication for Critical Function. It arises from improperly configured access control security levels, allowing unauthorized users to access critical functions without proper authentication. The CVSS 4.0 score of 9.4 reflects that the vulnerability can be exploited remotely over the network with low attack complexity and no user interaction, requiring only low privileges. The impact on confidentiality, integrity, and availability is high. The vendor has not issued a patch or advisory, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

The vulnerability allows unauthorized access to critical functions within the affected PDKS software, potentially leading to significant compromise of system confidentiality, integrity, and availability. Given the high CVSS score and lack of authentication, attackers with low privileges could exploit this remotely without user interaction. No known exploits are reported in the wild yet.

No official patch or fix is currently available as the vendor has not responded to the disclosure. Users should monitor for vendor advisories for updates. In the meantime, restrict network access to the affected PDKS system to trusted users only and implement compensating controls such as network segmentation or additional authentication layers if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.