Hard-coded passwords in KlinikaXP
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update. This issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1 Beside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA KlinikaXP Insertino (BRI) Fixed in 3.1.0.1
- Fix · CNA KlinikaXP (BRI) Fixed in 5.39.01.01
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1958
- 2026-10-03 Alias added: GHSA-jwgm-6w3j-r9x7
References
Other 1
Sources
- CVE-2026-1958 · CVE Program
- CVE-2026-1958 · NVD
- FIRST EPSS
- GHSA-jwgm-6w3j-r9x7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences