This vulnerability in Telecash Ricaricaweb arises from unsafe deserialization of untrusted data, enabling attackers to perform object injection. Such flaws typically allow remote attackers to execute arbitrary code or manipulate application logic by sending crafted serialized objects. The affected versions are from initial releases through 2.2. The CVSS 3.1 base score of 9.8 reflects the critical impact with full confidentiality, integrity, and availability compromise possible without any privileges or user interaction.

Successful exploitation can lead to remote code execution or other severe impacts compromising the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score, attackers can fully control the vulnerable application remotely. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable Telecash Ricaricaweb versions to untrusted networks or inputs. Monitor vendor channels for updates and apply patches promptly once released.