// For flags

CVE-2024-50588

Unprotected Exposed Firebird Database with default credentials

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

An unauthenticated attacker with access to the local network of the
medical office can use known default credentials to gain remote DBA
access to the Elefant Firebird database. The data in the database
includes patient data and login credentials among other sensitive data.
In addition, this enables an attacker to create and overwrite arbitrary
files on the server filesystem with the rights of the Firebird database
("NT AUTHORITY\SYSTEM").

Un atacante no autenticado con acceso a la red local del consultorio médico puede utilizar credenciales predeterminadas conocidas para obtener acceso remoto de administrador de base de datos a la base de datos Firebird de Elefant. Los datos de la base de datos incluyen datos de pacientes y credenciales de inicio de sesión, entre otros datos confidenciales. Además, esto permite a un atacante crear y sobrescribir archivos arbitrarios en el sistema de archivos del servidor con los derechos de la base de datos Firebird ("NT AUTHORITY\SYSTEM").

HASOMED Elefant versions prior to 24.04.00 and Elefant Software Updater versions prior to 1.4.2.1811 suffer from having an unprotected exposed firebird database, unprotected FHIR API, multiple local privilege escalation, and hardcoded service password vulnerabilities.

*Credits: Tobias Niemann, SEC Consult Vulnerability Lab, Daniel Hirschberger, SEC Consult Vulnerability Lab, Florian Stuhlmann, SEC Consult Vulnerability Lab
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-10-25 CVE Reserved
  • 2024-11-08 CVE Published
  • 2024-11-08 CVE Updated
  • 2024-11-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-419: Unprotected Primary Channel
  • CWE-1393: Use of Default Password
CAPEC
  • CAPEC-70: Try Common or Default Usernames and Passwords
References (2)
URL Tag Source
https://r.sec-consult.com/hasomed Third Party Advisory
URL Date SRC
URL Date SRC
https://hasomed.de/produkte/elefant 2024-11-08
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
---- -