Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-8306 and CVE-2025-8307) found in Asseco InfoMedica Plus software.
Analysis Summary
This summary details the two vulnerabilities discovered in Asseco InfoMedica Plus software, based on the CERT Polska advisory.
***
# Vulnerability: Insufficient Access Control and Weak Password Storage in Asseco InfoMedica Plus
## CVE Details
- **CVE ID:** CVE-2025-8306
- **CVSS Score:** *Score not provided in source* (Severity implied to be high due to privilege escalation potential)
- **CWE:** CWE-1220 (Insufficient Granularity of Access Control)
- **CVE ID:** CVE-2025-8307
- **CVSS Score:** *Score not provided in source* (Severity implied to be high due to credential compromise potential)
- **CWE:** CWE-257 (Storing Passwords in a Recoverable Format)
## Affected Systems
- **Products:** Asseco InfoMedica Plus
- **Versions:**
* Versions starting from 4.0.0 up to and including 4.50.1
* Versions starting from 5.0.0 up to and including 5.38.0
- **Configurations:** General installation of affected versions.
## Vulnerability Description
**CVE-2025-8306 (Access Control Flaw):** A low-privileged user can bypass granularity controls and obtain encoded passwords belonging to other accounts, including the main administrator account.
**CVE-2025-8307 (Weak Password Storage):** Passwords for all users are stored in an encoded format within the database. Critically, the client-side software contains the algorithm necessary to decode these stored credentials, making them recoverable by an attacker who gains access to the encoded data.
**Chained Exploitation:** Exploiting both vulnerabilities allows an attacker to escalate privileges significantly, potentially leading to full administrative control.
## Exploitation
- **Status:** *Information not provided regarding active exploitation or PoC availability, but technical details suggest high exploitability via chained attack.*
- **Complexity:** *Not explicitly stated, but the ability for a low-privileged user to obtain admin credentials suggests low execution complexity.*
- **Attack Vector:** Likely **Local** or **Network** depending on how the attacker gains initial access to the system/database contents.
## Impact
- **Confidentiality:** High (Ability to retrieve administrator and user credentials)
- **Integrity:** High (Potential to modify sensitive system data via escalated privileges)
- **Availability:** Moderate to High (Impact depends on post-exploitation actions)
## Remediation
### Patches
The vendor (Asseco) has resolved these issues in the following versions:
- **Version 4.50.1** (and later versions in the 4.x branch)
- **Version 5.38.0** (and later versions in the 5.x branch)
### Workarounds
- *No specific workarounds were detailed in the provided source information.* (The primary mitigation is immediate patching.)
## Detection
- **Indicators of compromise:** *Specific IoCs were not provided.* However, monitoring database access logs for unusual query attempts or successful retrieval of hashed/encoded password fields by non-administrative accounts, or any observed privilege escalation, should be considered.
- **Detection methods and tools:** Standard application security monitoring and configuration audits comparing deployed versions against the patched versions (4.50.1 and 5.38.0).
## References
- **Vendor advisories:** [Information provided via CERT Polska disclosure coordination.]
- **Relevant links - defanged:**
* [https://www.cve.org/CVERecord?id=CVE-2025-8306]
* [https://www.cve.org/CVERecord?id=CVE-2025-8307]
* [https://cert.pl/en/cvd/]