CVE-2024-50588

Unprotected Exposed Firebird Database with default credentials

State: Published
Severity: 9.8 Critical
Published: Nov 8, 2024
Updated: Nov 3, 2025
Reserved: Oct 25, 2024

Description

An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enables an attacker to create and overwrite arbitrary files on the server filesystem with the rights of the Firebird database ("NT AUTHORITY\SYSTEM").

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-1393 Use of Default Password
CWE-419 Unprotected Primary Channel

Affected Products

Product	Versions
ElefantHASOMED	<24.03.03Affected

References

https://r.sec-consult.com/hasomedthird-party-advisory
https://hasomed.de/produkte/elefant/patch
http://seclists.org/fulldisclosure/2024/Nov/3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.