This vulnerability (CVE-2025-0645) in Pyxis Signage allows an attacker with high privileges to upload files of dangerous types without proper restrictions, due to access control list (ACL) misconfigurations. This can lead to unauthorized access or execution of malicious files, impacting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction required, but requires high privileges. The product is not a cloud service, and no patch or vendor advisory is currently available.

Successful exploitation could result in full compromise of the affected system, including unauthorized access to sensitive functionality and potential execution of malicious files. This impacts confidentiality, integrity, and availability at a high level. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality to trusted users only and monitor for suspicious file uploads. Avoid exposing the affected system to untrusted networks where possible.