CVE-2024-50588 Unprotected Exposed Firebird Database with default credentials
An attacker can use default credentials to access the Firebird database, read sensitive patient data, and execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50588?
CVE-2024-50588 is a critical vulnerability in HASOMED Elefant, published on 8 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enables an attacker to create and overwrite arbitrary files on the server filesystem with the rights of the Firebird database ("NT AUTHORITY\SYSTEM").
Which versions are affected by CVE-2024-50588?
How do I fix CVE-2024-50588?
No fix has been published for CVE-2024-50588 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-50588 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50588 exists.
Sources
Also known as GHSA-8xpw-v6vw-79jf.