CVE-2025-8307

MediumCVSS 5.9

Published: 08/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Asseco InfoMedica stores all users' passwords in a database in an encoded format. An attacker in possession of these encoded passwords can decode them using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

Risk Assessment

Breach of user password confidentiality can lead to unauthorized access to accounts and systems, posing a serious threat to medical data security.

Recommendation

Update Asseco InfoMedica to version 4.50.1 or 5.38.0 (or later). It is also recommended to force a password change for all users.

Other vulnerabilities in Asseco InfoMedica

CVE-2025-8306Medium
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control. Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

Original NVD description (English source)

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0

Vulnerability data from NVD (NIST) · CISA KEV · EPSS