This vulnerability involves code injection via the GroovyShell.evaluate function in the /execute file of the NoticeController component in DefaultFuction Notice-System-Managent 2.0. Remote attackers can exploit this flaw to execute arbitrary code. The exploit has been publicly released. The vendor has confirmed awareness and is working on remediation, but no patch or official fix has been published yet.

Successful exploitation allows remote attackers to inject and execute arbitrary code on affected systems running DefaultFuction Notice-System-Managent 2.0. This can lead to unauthorized control or compromise of the affected system. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate risk with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has stated the issue is being processed but no official fix is available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the vulnerable component and applying any available compensating controls to limit exposure.