This vulnerability concerns improper access controls in the SitewiseCustomFunction of the Lambda Function Handler within nxp-auto-goldvip gvip versions 1.0 through 1.4.0. The root cause is a historical IAM permission misconfiguration allowing potentially unauthorized remote access. The issue was fixed starting with version 1.13.0, with further permission updates in version 1.15.0. The vendor manages this as a cloud service and has taken steps to update or deprecate older vulnerable versions in the AWS SAR application repository.

The vulnerability allows remote attackers to bypass intended access controls due to improper IAM permissions, potentially leading to unauthorized actions within the affected Lambda function. The CVSS 4.0 base score is 5.1 (medium severity), indicating a moderate impact with network attack vector, low complexity, and no user interaction required. There are no known exploits in the wild at this time.

A fix is available by upgrading to version 1.15.0 or later, which includes corrected IAM permission configurations. The vendor has addressed the issue starting with version 1.13.0 and recommends upgrading affected deployments. Additionally, the vendor has requested updating or deprecating older vulnerable versions in the AWS SAR repository. Since this is a cloud-hosted service, the vendor manages remediation server-side; users should verify they are using a patched version or updated deployment.