The CVSS 7.5 score on this CVE is misleading. The vulnerability is an unauthenticated IDOR in a cloud-connected device API, and the 'unauthenticated' qualifier is the real severity multiplier that the scoring system cannot capture.
When an IDOR requires authentication, attackers must at least obtain a valid session before manipulating object references—creating friction that limits opportunistic exploitation. This one requires nothing. Automated tooling can harvest cross-user data at scale without completing a login flow or token exchange. The object reference is likely a predictable identifier (user ID, UUID, sequential record), which defenders can enumerate passively. That's the compound condition that makes this dangerous: zero authentication plus predictable reference equals trivial automated discovery.
But the vulnerability itself is a symptom, not the root cause. The developer who built this API almost certainly wasn't thinking 'I'll skip authentication on this endpoint'—they were thinking 'this is just a read-only query, no need for auth overhead.' Authentication wasn't a security consideration during API design; it was an absence of thought. This is a design-time decision failure that CVSS measures as a bug rather than a process gap.
Here's what matters for defenders: when authentication is an afterthought at the architecture level, it almost never affects a single endpoint. There's likely a cluster of endpoints sharing the same orphaned assumption. The unauthenticated IDOR isn't just a vulnerability—it's a signal to attackers about where else the walls aren't there. Your remediation should not be 'patch this endpoint.' Your remediation should be: audit every endpoint in that trust domain. Assume the entire API surface is suspect until proven otherwise.
If you're a security engineer reviewing this CVE against your inventory, the question isn't 'do we have this product.' The question is: do we have any API endpoints where we assumed authentication was unnecessary because the data seemed innocuous, or because the attacker 'needed the device first'? That assumption breaks the moment you expose a companion mobile API or cloud interface. If you find one unauthenticated endpoint, keep looking—there's a cluster.