Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums.
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- CompuGroup Medical
- Product
- Infantia, Profim, Venere
- CVSS v4.0
- 9.2 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-494
- NVD status
- Received
Why it ranks 33 (Notable)
- CVSS v4.0 9.2 critical
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.