This vulnerability affects the dromara orion-visor project versions 2.5.0 through 2.5.7. The issue is located in the ExposeApiAspect.beforeExposeApi function within the ExposeApiAspect.java file, where hard-coded credentials are present. An attacker can remotely exploit this weakness to potentially gain unauthorized access. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. Although the exploit is publicly available, there is no vendor response or patch at this time.

The presence of hard-coded credentials allows remote attackers to potentially bypass authentication or gain unauthorized access to the affected system. This can lead to unauthorized operations or data exposure depending on the privileges associated with the credentials. The medium CVSS score reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider restricting network access to the affected service and auditing usage of the exposed API to detect suspicious activity.