This vulnerability affects the SMSGate sms-core software up to version 2.1.13.6. It involves the Cmpp7FDeliverRequestMessageCodec.java component, which can be exploited remotely without authentication to execute arbitrary code. The CVSS v3.1 base score is 7.3, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The CWE-502 classification suggests the root cause is related to unsafe deserialization or similar unsafe coding practices that allow code injection or execution.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to partial loss of confidentiality, integrity, and availability of the system. This could compromise the SMSGate service and any data it processes or controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, organizations should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the vulnerable component if possible and apply any recommended security controls from the vendor once released.