A hospital management backend leaked its own system information

MedDevice Cyber Staff · Oct 28 · 2 min read · Via CISA

Vertikal Systems Hospital Manager Backend Services got ICSMA-25-301-01. CVE-2025-54459 at 7.5, exposure of sensitive system information to an unauthorized control sphere, plus CVE-2025-61959, error messages that hand out sensitive information. Together they give an attacker unauthorized access to a hospital management backend and a tidy way to enumerate it through verbose errors. Pundhapat Sichamnong reported it.

Information disclosure of this kind rarely does harm on its own; its value is preparatory. A backend that reveals internal paths, component names or configuration to an unauthorized request hands an intruder the layout of a system they have not yet broken into, shortening the distance between a first probe and a focused attack. Verbose error messages make it worse by turning ordinary faults into a steady leak.

The weakness recurs because building software and running it want opposite things from an error. During development a detailed trace that names the failing component saves hours; on a system reachable over a network, that same detail is reconnaissance served on demand. Systems that never cleanly separate the two modes ship the developer's convenience straight to whoever sends a malformed request.

A hospital management backend sits behind the scheduling, records and administrative functions a facility runs on, so unauthorized reach into it exposes the connective tissue of operations rather than a single record. Combined with an easy way to enumerate the system through its own error output, a modestly rated disclosure becomes the opening move of a longer intrusion rather than a footnote.

Every stack trace and config detail returned to the client is a map for an attacker doing reconnaissance. Return generic errors to the user and keep the detail in your logs. The person triggering the exception is not always the person you want to help.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The Vertikal Systems Hospital Manager backend exposed sensitive system information to unauthorized users and returned error messages stuffed with more of it (ICSMA-25-301-01). Apply the fix, gate the exposed endpoints behind authentication, and strip internal detail from error responses.

Apply the vendor fix. Update to the remediated version from ICSMA-25-301-01.
Authenticate the exposed endpoints. System information should require an authorized session, not be readable by an unauthenticated caller.
Return generic errors. Log detail server-side and send clients a generic message so errors do not leak internal state.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

data_phi

Contributing

net_remote_access app_user_accounts net_cloud app_web_ui app_roles app_database use_hospital_net

EMB3D

PID-28 PID-311 PID-34

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What was disclosed in Vertikal Systems Hospital Manager?

ICSMA-25-301-01 covers CVE-2025-54459 at 7.5, exposure of sensitive system information to unauthorized users, and CVE-2025-61959, error messages that leak more of it. Pundhapat Sichamnong reported both.

What is the defensive takeaway on verbose errors?

Return generic errors to the client and keep detail in server logs. Stack traces and configuration data in responses hand an attacker a reconnaissance map.

← Back to Vulnerabilities