LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A hospital management backend leaked its own system information

MedDevice Cyber Staff · Oct 28 · 2 min read · Via CISA

Vertikal Systems Hospital Manager Backend Services got ICSMA-25-301-01. CVE-2025-54459 at 7.5, exposure of sensitive system information to an unauthorized control sphere, plus CVE-2025-61959, error messages that hand out sensitive information. Together they give an attacker unauthorized access to a hospital management backend and a tidy way to enumerate it through verbose errors. Pundhapat Sichamnong reported it.

Every stack trace and config detail returned to the client is a map for an attacker doing reconnaissance. Return generic errors to the user and keep the detail in your logs. The person triggering the exception is not always the person you want to help.

Remediation Desk

The Vertikal Systems Hospital Manager backend exposed sensitive system information to unauthorized users and returned error messages stuffed with more of it (ICSMA-25-301-01). Apply the fix, gate the exposed endpoints behind authentication, and strip internal detail from error responses.

Apply the vendor fix. Update to the remediated version from ICSMA-25-301-01.
Authenticate the exposed endpoints. System information should require an authorized session, not be readable by an unauthenticated caller.
Return generic errors. Log detail server-side and send clients a generic message so errors do not leak internal state.

Sources

CISA ↗

Questions & Answers

What was disclosed in Vertikal Systems Hospital Manager?

ICSMA-25-301-01 covers CVE-2025-54459 at 7.5, exposure of sensitive system information to unauthorized users, and CVE-2025-61959, error messages that leak more of it. Pundhapat Sichamnong reported both.

What is the defensive takeaway on verbose errors?

Return generic errors to the client and keep detail in server logs. Stack traces and configuration data in responses hand an attacker a reconnaissance map.

← Back to Vulnerabilities