This vulnerability (CVE-2026-66463) affects iCARRY versions up to 2.9 and involves the insertion of sensitive information into sent data without authentication. The CVSS 3.1 score is 7.5, indicating high severity, with an attack vector of network, no privileges required, and no user interaction needed. The vulnerability results in high confidentiality impact but does not affect integrity or availability. No known exploits are reported in the wild, and no vendor remediation or patch information is currently available.

An unauthenticated attacker can access sensitive information transmitted by the affected iCARRY versions, potentially leading to data leakage. The confidentiality of data is compromised, but integrity and availability remain unaffected. This could expose sensitive user or system data to unauthorized parties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting network access to the affected service where possible and monitor for unusual data transmissions. Follow vendor updates closely for official patches or mitigations.