CVE-2024-53522 Hardcoded credentials in n/a
Attackers can access sensitive information due to hardcoded cryptographic keys in the medical software application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-53522?
CVE-2024-53522 is a high-severity vulnerability in n/a, published on 7 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information.
Weakness: CWE-331
Which versions are affected by CVE-2024-53522?
How do I fix CVE-2024-53522?
No fix has been published for CVE-2024-53522 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-53522 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53522 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-w3jp-95q8-wv48.