CVE-2026-1958

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1958", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-02-05T10:05:53.336Z", "datePublished": "2026-03-23T12:40:12.895Z", "dateUpdated": "2026-03-23T15:51:31.644Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "KlinikaXP Insertino", "vendor": "BRI", "versions": [{"lessThan": "3.1.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "KlinikaXP", "vendor": "BRI", "versions": [{"lessThan": "5.39.01.01", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wojciech Gie\u0142da"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.<br><br>This issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1<br><br>Beside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts."}], "value": "Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.\n\nThis issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1\n\nBeside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-03-23T12:40:12.895Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2026/03/CVE-2026-1958"}, {"tags": ["product"], "url": "https://www.klinikaxp.pl/"}], "source": {"discovery": "EXTERNAL"}, "title": "Hard-coded passwords in KlinikaXP", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:17:46.045147Z", "id": "CVE-2026-1958", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:51:31.644Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1958", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:17:46.045147Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:17:47.221Z"}}], "cna": {"title": "Hard-coded passwords in KlinikaXP", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Wojciech Gie\u0142da"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BRI", "product": "KlinikaXP Insertino", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "BRI", "product": "KlinikaXP", "versions": [{"status": "affected", "version": "0", "lessThan": "5.39.01.01", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/posts/2026/03/CVE-2026-1958", "tags": ["third-party-advisory"]}, {"url": "https://www.klinikaxp.pl/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.\n\nThis issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1\n\nBeside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts.", "supportingMedia": [{"type": "text/html", "value": "Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.<br><br>This issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1<br><br>Beside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-03-23T12:40:12.895Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1958", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:51:31.644Z", "dateReserved": "2026-02-05T10:05:53.336Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-03-23T12:40:12.895Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "KlinikaXP Insertino", "vendor": "BRI", "versions": [{"lessThan": "3.1.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "KlinikaXP", "vendor": "BRI", "versions": [{"lessThan": "5.39.01.01", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.\n\nThis issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1\n\nBeside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts."}, {"lang": "es", "value": "El uso de credenciales codificadas en Klinika XP y KlinikaXP Insertino permiti\u00f3 a un atacante no autorizado acceder a varios servicios internos. Cr\u00edticamente, esto inclu\u00eda el acceso al servidor FTP que alojaba los paquetes de actualizaci\u00f3n de la aplicaci\u00f3n. El atacante con estas credenciales podr\u00eda cargar un archivo de actualizaci\u00f3n malicioso, el cual podr\u00eda haber sido distribuido e instalado en m\u00e1quinas cliente como una actualizaci\u00f3n leg\u00edtima.\n\nEste problema afecta a KlinikaXP: antes de la 5.39.01.01. y a KlinikaXP Insertino antes de la 3.1.0.1.\n\nAdem\u00e1s de eliminar las credenciales codificadas del c\u00f3digo, las credenciales previamente expuestas tambi\u00e9n fueron rotadas, evitando futuros intentos de ataque."}], "id": "CVE-2026-1958", "lastModified": "2026-06-17T10:16:46.583", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1958", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:17:46.045147Z", "version": "2.0.3"}}]}, "published": "2026-03-23T13:16:30.093", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/03/CVE-2026-1958"}, {"source": "cvd@cert.pl", "url": "https://www.klinikaxp.pl/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.39.01.01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "KlinikaXP", "source": "cna", "vendor": "BRI"}, "product": "klinikaxp", "vendor": "bri"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.1.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "KlinikaXP Insertino", "source": "cna", "vendor": "BRI"}, "product": "klinikaxp_insertino", "vendor": "bri"}], "analysis": {"en": {"generated_at": "2026-03-23T15:05:43.129594+00:00", "value": {"mitigation_remediation": ["Upgrade KlinikaXP to version 5.39.01.01 or later and KlinikaXP Insertino to version 3.1.0.1 or later to remove the hard\u2011coded credentials", "If immediate upgrade is not possible, rotate any passwords that were previously exposed by the hard\u2011coded credentials", "Restrict access to the internal FTP service to trusted hosts only and enforce authentication", "Verify the integrity of all update files before deployment and consider implementing code signing", "Monitor the FTP server for any unauthorized upload activity"], "summary": {"action": "Apply Patch", "impact": "Unauthorized access leading to malicious update deployment"}, "threat_synthesis": {"affected_systems": "The affected products are BRI\u2019s KlinikaXP and KlinikaXP Insertino. Versions prior to 5.39.01.01 of KlinikaXP and prior to 3.1.0.1 of KlinikaXP Insertino are vulnerable. All later releases contain remediation that removes the hard\u2011coded credentials and rotates any exposed passwords.", "description_and_impact": "The vulnerability arises from hard\u2011coded credentials embedded in KlinikaXP and KlinikaXP Insertino. These credentials grant an attacker unauthorised access to multiple internal services, notably the FTP server that stores the application\u2019s update packages. An attacker who obtains these credentials can upload a malicious update file to that FTP server. If clients download and install the compromised update, the attacker effectively injects malicious code into all affected systems, compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 8.7 classifies this as a high\u2011severity issue. EPSS data are currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves the attacker gaining network or local access to the internal services and then using the hard\u2011coded credentials to authenticate to the FTP server. Once authenticated, the attacker can upload a malicious update, which clients may inadvertently install. This scenario offers a straightforward exploitation route with severe potential impact, especially if the update mechanism lacks integrity checks."}}}}, "created": "2026-03-24T10:34:35.705161+00:00", "updated": "2026-03-25T14:49:09.955461+00:00", "vendors": ["bri", "bri$PRODUCT$klinikaxp", "bri$PRODUCT$klinikaxp_insertino"]}