This vulnerability arises from the use of default credentials in the CISA Malcolm product. Specifically, an example environment-configuration file shipped with the product includes a fixed administrative password for a bundled inventory-management component. Deployments that copy this example file into active configuration without executing the setup routine to regenerate unique credentials leave the administrative interface accessible to anyone who knows the default password. This is classified under CWE-1392 (Use of Default Credentials).

An attacker aware of the default administrative password can gain unauthorized administrative access to the inventory-management component of CISA Malcolm. This could lead to full control over that component, potentially compromising the confidentiality, integrity, and availability of the system. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or fix is indicated in the provided data. The primary mitigation is to ensure that the setup routine is run during deployment to regenerate unique administrative credentials instead of using the example configuration file as-is. Administrators should verify that default credentials are not in use and replace them with secure, unique passwords.