This vulnerability in CodeWise Tornet Scooter Mobile App 4.75 affects an unknown function in the /TwoFactor file, leading to improper restriction of excessive authentication attempts. This weakness could allow an attacker to perform repeated authentication attempts remotely, potentially facilitating brute force or credential stuffing attacks. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, high attack complexity, and no privileges or user interaction required. The vendor has not provided any remediation or patch, and no known exploits are reported in the wild.

The vulnerability allows remote attackers to bypass proper rate limiting on authentication attempts, which could lead to unauthorized access if combined with other weaknesses or valid credentials. However, the high complexity of exploitation and lack of privileges or user interaction reduces the likelihood of successful exploitation. No direct evidence of active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from CodeWise. Until a patch is released, consider implementing additional protective controls such as external rate limiting or multi-factor authentication if possible.