This vulnerability in Genian SSL PNS (frodo-core) arises from improper privilege management (CWE-269). An attacker can escalate privileges to super administrator level by exploiting the CSV bulk user registration feature, specifically by manipulating the permission column. This could allow forced creation of OS accounts with elevated privileges. The affected versions are all releases from 0 up to but excluding 5.0.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation results in privilege escalation to super administrator level and forced creation of OS accounts, potentially compromising system integrity and control. This could lead to unauthorized administrative access and control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict access to the CSV bulk user registration functionality to trusted administrators only and monitor for suspicious activity related to user account creation.