Executive brief
KlinikaXP is a management system used by veterinary clinics to handle patient records, appointments, and finances. A security flaw involving hard-coded credentials allowed unauthorized access to internal services, including the server used to distribute software updates. An attacker could have used this access to distribute malicious software updates to client machines, potentially compromising veterinary clinic operations and data.
Technical details
The vulnerability is classified as Use of Hard-coded Credentials (CWE-798) within the KlinikaXP and KlinikaXP Insertino software suites. These credentials provided unauthenticated network access to several internal services, most notably the FTP server responsible for hosting application update packages. An attacker could leverage these credentials to upload a malicious update file, which would then be distributed to and executed by client installations as a legitimate update. The vendor has addressed the issue by removing the hard-coded credentials from the source code and rotating the credentials for the affected internal services.
Affected products
- BRI KlinikaXP before 5.39.01.01
- BRI KlinikaXP Insertino before 3.1.0.1
Timeline
- 2026-03-23: disclosed: Vulnerability disclosed by CERT Polska
- 2026-03-23: advisory