The vulnerability arises from improper access restrictions in the AppEngine Fileaccess over HTTP feature of InspectorP61x, which unintentionally exposes critical filesystem directories without requiring authentication. Attackers can access device parameter files to read or alter application settings, including customer-defined passwords. Furthermore, exposure of the custom application directory enables execution of arbitrary Lua code within the sandboxed AppEngine environment, increasing the risk of unauthorized control or manipulation of the device.

Successful exploitation allows unauthenticated attackers to read and modify sensitive device parameters, including passwords, compromising confidentiality and integrity. Additionally, arbitrary Lua code execution within the sandboxed environment can lead to further unauthorized actions, potentially impacting device availability. The CVSS score of 9.4 reflects the high severity and ease of exploitation over the network without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict network access to the affected device's HTTP file access feature to trusted users only, and monitor for any unusual activity related to file access.