This vulnerability in Ercom Cryptobox involves the external sharing feature where an attacker with knowledge of a sharing link URL can obtain server information enabling an offline brute-force attack on the access code associated with that link. The root cause is improper handling of insufficient permissions or privileges (CWE-280). The CVSS 4.0 base score is 6.9, reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. No patch or official remediation level has been published by the vendor, and the product is not a cloud service.

An attacker who obtains a sharing link URL can attempt an offline brute-force attack to guess the access code protecting the shared resource. Successful exploitation could lead to unauthorized access to information shared via Cryptobox. However, the impact on confidentiality is rated low according to the CVSS vector, and there is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting the distribution of sharing links and monitor for suspicious access patterns. No vendor-provided mitigation or temporary fix is currently available.