CVE-2025-8307 Recoverable passwords in Asseco Infomedica Plus
Attackers can decode user passwords stored in the database using a client-side algorithm, leading to credential theft and unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8307?
CVE-2025-8307 is a medium-severity vulnerability in Asseco InfoMedica Plus, published on 8 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0
Weakness: CWE-257
Which versions are affected by CVE-2025-8307?
How do I fix CVE-2025-8307?
No fix has been published for CVE-2025-8307 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8307 being exploited?
There is no known exploitation of CVE-2025-8307 in the wild and no public exploit code.
Sources
Also known as GHSA-vx77-f96x-gpjp.