Full Report
Use of Hard-coded Credentials vulnerability (CVE-2026-17038) has been found in drEryk Gabinet software.
Analysis Summary
# Vulnerability: Hard-coded API Credentials in drEryk Gabinet
## CVE Details
- **CVE ID**: CVE-2026-17038
- **CVSS Score**: Not explicitly provided in the source (Typically High for hard-coded credentials with API access)
- **CWE**: CWE-798 (Use of Hard-coded Credentials)
## Affected Systems
- **Products**: drEryk Gabinet
- **Versions**: All versions prior to 11.5.0
- **Configurations**: Systems utilizing the ticket reporting component.
## Vulnerability Description
The drEryk Gabinet software contains hard-coded API credentials within its ticket reporting component. Because these credentials are fixed within the software code, an attacker can extract them and use them to authenticate directly to the backend ticket system API. This bypasses the standard application interface and restrictions.
## Exploitation
- **Status**: Reported to CERT Polska (No mention of active exploitation in the wild).
- **Complexity**: Low (Credentials are static and embedded in the software).
- **Attack Vector**: Network (Access to the API endpoint is required).
## Impact
- **Confidentiality**: High (Allows unauthorized reading of support tickets).
- **Integrity**: High (Allows unauthorized modification of support tickets).
- **Availability**: Low/Medium (Depending on the ability to delete or disrupt ticket workflows).
## Remediation
### Patches
- **Version 11.5.0**: The vendor has released version 11.5.0 which addresses this vulnerability. Users are advised to upgrade to this version or newer immediately.
### Workarounds
- Restrict network access to the ticket system API endpoints to authorized IP addresses only, if possible.
- Monitor for unusual API activity originating from sources other than the application's legitimate backend.
## Detection
- **Indicators of Compromise**: Multiple API requests to the ticket system using a single, static set of credentials from various client workstations.
- **Detection Methods**: Inspect software binaries or configuration files for embedded API keys/secrets (primarily for researchers/auditors).
## References
- **Vendor Advisory**: hxxps[://]cert[.]pl/en/posts/2026/09/cve-2026-17038/
- **CVE Record**: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-17038
- **CWE-798**: hxxps[://]cwe[.]mitre[.]org/data/definitions/798[.]html