This vulnerability affects the AstrBotDevs AstrBot product up to version 4.25.2. The flaw exists in the FutureTaskTool.call function within the file astrbot/core/tools/cron_tools.py, part of the Scheduled Task Handler component. Improper authorization occurs when an attacker manipulates the payload["note"] argument, potentially allowing unauthorized remote actions. The exploit code is publicly available, increasing the risk of exploitation. The vendor was notified but has not issued any advisory or patch, and no official remediation level is provided.

Successful exploitation allows an attacker with low privileges to perform unauthorized actions remotely by manipulating the payload["note"] argument in the scheduled task handler. This could lead to unauthorized task execution or other impacts related to the scheduled task functionality. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and limited scope and impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider applying compensating controls such as restricting access to the affected function or component, monitoring for suspicious activity related to scheduled tasks, and limiting privileges of users who can interact with the vulnerable functionality until an official fix is available.