This vulnerability (CVE-2024-6400) in Finrota Netahsilat arises from cleartext storage of sensitive information (CWE-312) and exposure of sensitive data through data queries (CWE-202). It allows attackers with limited privileges and user interaction to retrieve sensitive embedded data, bypass authentication mechanisms, inject commands into IMAP/SMTP protocols, and collect data from common resource locations. The vulnerability is addressed in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11, and 1.24.03 of the product. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction needed, and high impact on confidentiality and security controls.

Successful exploitation can lead to exposure and retrieval of sensitive information, authentication bypass, and command injection attacks on IMAP/SMTP services, potentially compromising confidentiality and security of the affected system. The high CVSS score (8.2) reflects significant impact on confidentiality and security controls with limited attacker privileges required.

A fix is available and has been implemented in Finrota Netahsilat versions 1.21.10, 1.23.01, 1.23.08, 1.23.11, and 1.24.03. Users should upgrade to one of these patched versions to remediate the vulnerability. Since this is not a cloud service, remediation requires applying the official vendor patches. Patch status is confirmed by the vendor advisory embedded in the description.