This vulnerability in the RTU500 series CMU firmware permits bypassing the secure update mechanism under the condition that the secure update feature is not uniformly enabled across all CMUs in the device. An authenticated and authorized user could exploit this to install unsigned firmware, undermining device security. The CVSS 3.1 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with authenticated access to install unsigned firmware on the RTU500 device, potentially leading to full compromise of device integrity, confidentiality, and availability. This could affect the operational security of systems relying on the RTU500 series devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that the secure update feature is enabled on all CMUs of an RTU500 device to prevent bypass of the secure update mechanism.