This vulnerability in OZOLS software arises from the automatic update mechanism that downloads code without verifying its integrity, uses untrusted control sources, and transmits sensitive information in cleartext. The affected components include the OzolsSQL client update path, the <db>_update SQL Server Agent job using ActiveScripting, and the serv_update.vbs script. The root cause is an abandoned auto-update domain, which can be exploited to inject malicious updates or intercept sensitive data. The vulnerability affects OZOLS versions prior to 1.1.1233. No official patch or remediation level has been published by the vendor as of the data provided.

The vulnerability allows remote attackers to execute arbitrary code without user interaction due to the lack of integrity checks on downloaded code. Additionally, sensitive information is transmitted in cleartext, increasing the risk of interception and data leakage. The inclusion of functionality from an untrusted control sphere further elevates the risk of unauthorized code execution and system compromise. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the automatic update feature or restrict network access to the update domain to prevent exploitation. Monitor for any updates from Ozols Grupa regarding patches or mitigations. Avoid using affected versions in sensitive environments if possible.