CVE-2025-8306

4th percentile - higher than 4% of all known CVEs

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control. Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

Disclosure of passwords for all accounts can lead to full system compromise, including the administrator account, posing a serious threat to the confidentiality of medical data.

Update Asseco InfoMedica to version 4.50.1 or 5.38.0, which include the fix. Additionally, change passwords for all accounts after the update.