This vulnerability in Oinone Pamirs (up to version 7.2.0) arises from unsafe deserialization in the JsonUtils.parseMap function of the PamirsParserConfig.java file, part of the appConfigQuery interface. Remote attackers can manipulate input to trigger deserialization, potentially leading to security issues. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating moderate impact with low attack complexity and no required privileges or user interaction. No official remediation or patch has been provided, and the vendor has not responded to disclosure attempts.

Successful exploitation could allow remote attackers to manipulate deserialization processes, which may lead to unauthorized code execution or other security impacts depending on the deserialized data handling. The CVSS score of 5.3 reflects a medium severity with potential impact on confidentiality, integrity, and availability, but with limited scope and complexity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying additional security controls such as input validation or disabling the vulnerable functionality if feasible. Monitor for updates from the vendor or trusted security sources for any forthcoming patches or official mitigations.