Full Report
Use of Hard-coded Credentials vulnerability (CVE-2026-1958) has been found in KlinikaXP and KlinikaXP Insertino software.
Analysis Summary
# Vulnerability: Use of Hard-coded Credentials in KlinikaXP and KlinikaXP Insertino
## CVE Details
- **CVE ID:** CVE-2026-1958
- **CVSS Score:** Not explicitly rated in source (High severity implied due to potential for Supply Chain compromise)
- **CWE:** CWE-798 (Use of Hard-coded Credentials)
## Affected Systems
- **Products:**
- KlinikaXP (Veterinary management software)
- KlinikaXP Insertino (Client tablet/laptop application)
- **Versions:**
- KlinikaXP: All versions prior to 5.39.01.01
- KlinikaXP Insertino: All versions prior to 3.1.0.1
- **Configurations:** Systems utilizing the software's internal update mechanism from the vendor's FTP server.
## Vulnerability Description
The software contained hard-coded credentials within the application code. These credentials provided unauthorized access to several internal services managed by the vendor. Most significantly, the credentials allowed access to the FTP server responsible for hosting application update packages.
## Exploitation
- **Status:** Officially disclosed; no reports of exploitation in the wild mentioned, though the flaw represents a significant supply chain risk.
- **Complexity:** Low (Credentials were embedded in the software).
- **Attack Vector:** Network (Remote access to internal services/FTP).
## Impact
- **Confidentiality:** High (Access to internal services).
- **Integrity:** Critical (Attackers could upload malicious update files to the FTP server, leading to the distribution of compromised software to all clients).
- **Availability:** High (Potential for system-wide disruption via malicious updates).
## Remediation
### Patches
The vendor (BRI) has released updates to address this flaw. Users should upgrade to the following versions immediately:
- **KlinikaXP:** Version 5.39.01.01 or later.
- **KlinikaXP Insertino:** Version 3.1.0.1 or later.
### Workarounds
- No specific software workarounds provided; however, the vendor has officially **rotated the previously exposed credentials** on the server side to prevent further unauthorized access using the hard-coded strings.
## Detection
- **Indicators of Compromise:** Unusual activity on internal FTP logs or unexpected modifications to application update packages if monitored.
- **Detection methods:** Security teams can audit the version numbers of installed KlinikaXP software to ensure they meet the minimum patched requirements.
## References
- CERT Polska Advisory: hxxps://cert[.]pl/en/posts/2026/03/cert-polska-cve-2026-1958/
- CVE Record: hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-1958
- CWE-798 Detail: hxxps://cwe[.]mitre[.]org/data/definitions/798[.]html