This vulnerability affects the administrative HTTP endpoint of zhayujie chatgpt-on-wechat CowAgent 2.0.4, where missing authentication allows remote attackers to interact with the component without proper access control. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No patch or official remediation has been published, and the product is not a cloud service, so remediation depends on vendor action.

An attacker can remotely access the administrative HTTP endpoint without authentication, potentially leading to unauthorized actions on the affected system. The impact is rated medium with limited confidentiality, integrity, and availability effects. Exploit code is publicly available, increasing the risk of exploitation, though no known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates and consider restricting network access to the administrative HTTP endpoint as a temporary measure. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.