This vulnerability (CVE-2025-14349) affects Universal Software Inc.'s FlexCity/Kiosk versions 1.0 up to but not including 1.0.36. It is characterized by privilege definitions that include unsafe actions and missing authentication for critical functions, resulting in the ability to access functionality without proper ACL constraints. The CVSS 3.1 score is 8.8 (high), indicating network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-267 (Privilege Defined With Unsafe Actions) and CWE-306 (Missing Authentication for Critical Function). No patch or vendor advisory is provided, and the product is not a cloud service.

Successful exploitation allows an attacker with some privileges to escalate their privileges by accessing critical functions that lack proper authentication and ACL enforcement. This can compromise confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to affected versions and apply compensating controls where possible to limit privilege escalation risks.