Unprotected FHIR API
Priority HIGH 72CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-306.
Summary
An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR).
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Fixed Elefant (HASOMED): 24.04.00
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Elefant (HASOMED) Fixed in 24.04.00
Timeline
- 2026-10-02 Threatist record created from CVE-2024-50589
- 2026-10-03 Alias added: GHSA-mvcm-644q-5c9p
References
More HASOMED vulnerabilities
- TI-2024-34015 Unprotected Exposed Firebird Database with default credentials CVSS 3.1CRITICAL 9.8
- TI-2024-34020 Hardcoded service password in HASOMED Elefant CVSS 3.1HIGH 7.8
- TI-2024-34018 Local Privilege Escalation via Command Injection CVSS 3.1HIGH 7.8
- TI-2024-34017 Local Privilege Escalation via Weak Service Binary Permissions CVSS 3.1HIGH 7.8
- TI-2024-34019 Local Privilege Escalation via Race Condition CVSS 3.1HIGH 7.0
Sources
- CVE-2024-50589 · CVE Program
- CVE-2024-50589 · NVD
- FIRST EPSS
- GHSA-mvcm-644q-5c9p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences