This vulnerability (CVE-2024-12651) in PTT Inc.'s HGS Mobile App before version 6.5.0 is classified under CWE-749, indicating an exposed dangerous method or function. It permits attackers with limited privileges to manipulate user-controlled variables, potentially leading to a partial compromise of confidentiality and integrity. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects network attack vector, low complexity, requiring low privileges and no user interaction, with a scope change and high confidentiality impact but limited integrity and no availability impact. No vendor advisory or patch information is currently available.

The vulnerability allows an attacker with low privileges to manipulate variables controlled by users, potentially leading to a high confidentiality impact and partial integrity compromise within the HGS Mobile App environment. There is no reported impact on availability. The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable part. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level has been provided by PTT Inc., users should monitor vendor communications for updates. Until a patch is available, limit exposure by restricting access to the app to trusted users and environments where possible.