Read the docs
TI-2025-04109 Aliases CVE-2025-4596GHSA-xfxj-mh7v-h4rr

Information disclosure via IDOR in Asseco AMDX

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 version of ADMX.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed AMDX (Asseco): 6.09.01.62

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AssecoAMDXbefore 6.09.01.626.09.01.62Patch availableCNA
  • AMDX VendorAsseco Affected before 6.09.01.62 Fixed in 6.09.01.62 Patch available CNA

Remediation

  • Fix · CNA AMDX (Asseco) Fixed in 6.09.01.62

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4596
  2. 2026-10-03 Alias added: GHSA-xfxj-mh7v-h4rr

References

Other 1

  • TI-2022-10314 The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58… CVSS 3.1HIGH 7.5
  • TI-2025-41095 Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live… CVSS 3.1MEDIUM 6.5
  • TI-2025-07603 Recoverable passwords in Asseco Infomedica Plus CVSS 4.0MEDIUM 5.9
  • TI-2025-07602 Improper Access Control in Asseco Infomedica Plus CVSS 4.0MEDIUM 5.1
  • TI-2026-41696 Improper Restriction of XML External Entity Reference in proCertum SmartSign CVSS 4.0MEDIUM 4.8
  • TI-2026-41695 Arbitrary Path Execution via CPS URI in proCertum SmartSign CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences