This vulnerability in BichitroGan ISP Billing Software 2025.3.20 arises from improper control of resource identifiers in the Endpoint component, specifically in the /?_route=settings/users-view/ file. An attacker can manipulate the ID argument to gain unauthorized access or control over resources. The vulnerability is remotely exploitable without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. The vendor has not responded to disclosure and no patch or mitigation is currently available.

The vulnerability allows remote attackers to manipulate resource identifiers, potentially leading to unauthorized access or control over user-related resources in the ISP billing software. The impact is rated medium with low confidentiality impact and no integrity or availability impact according to the CVSS vector. Exploitation could compromise user data or system behavior related to user views.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor for updates from the vendor or trusted security sources. Until a fix is released, restricting access to the affected endpoint and applying network-level protections may reduce exposure.