This vulnerability in PassBox (versions before 1.2) is due to missing authentication on a critical function, enabling attackers with limited privileges to abuse authentication mechanisms. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial required privileges, no user interaction, and high impact on confidentiality. The issue is classified under CWE-306, which covers missing authentication for critical functions. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with limited privileges to abuse authentication mechanisms, potentially leading to unauthorized access or actions within the affected application. The high CVSS score reflects a significant confidentiality impact and moderate integrity and availability impacts. However, no known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected PassBox versions and monitor for unusual authentication activities. Avoid deploying affected versions in sensitive environments where possible.