This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), affects SMS Alert Order Notifications versions up to and including 3.9.7. It permits unauthenticated users to escalate their privileges, potentially leading to full control over the affected system. The CVSS 3.1 score of 9.8 reflects the critical nature of this issue, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation can result in complete compromise of the affected system, including unauthorized access and control, data confidentiality breaches, data integrity violations, and denial of service. Given the unauthenticated nature, the attack surface is broad, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system and monitor for suspicious activity related to privilege escalation attempts. Avoid deploying affected versions in exposed environments where possible.