This vulnerability in ETQ Reliance CG (legacy) arises from improper authentication controls that permit bypassing login restrictions by submitting the SYSTEM username, which does not require a password. Attackers with network access to the login interface can exploit this to gain elevated privileges. Post-authentication, they can execute arbitrary code remotely by altering Jython scripts used by the application. The vendor addressed this by implementing stricter validation logic in version MP-4583 to prevent internal accounts from being used in public authentication.

Successful exploitation grants attackers privileged SYSTEM-level access without authentication, enabling them to execute arbitrary code remotely within the application context. This can lead to full compromise of the affected system and potentially further lateral movement or data breaches. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in ETQ Reliance CG (legacy) version MP-4583, which introduces stricter validation to exclude internal SYSTEM accounts from public authentication workflows. Users of affected versions should upgrade to MP-4583 or later to remediate this vulnerability. No cloud service remediation applies as this is not a cloud-hosted product. Patch status is confirmed by the vendor advisory embedded in the description.