CVE-2024-3699: Hardcoded password in drEryk Gabinet

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-10 · updated 2026-06-17
Weakness: CWE-259

Description

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0.

Affected products

drEryk sp. z o.o. drEryk Gabinet: from 7.0.0.0 before 9.17.0.0 — fixed in 9.17.0.0

How to fix

Upgrade to a fixed version: drEryk sp. z o.o. drEryk Gabinet 9.17.0.0. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2024/06/CVE-2024-1228/
https://cert.pl/posts/2024/06/CVE-2024-1228/
https://dreryk.pl/produkty/gabinet/
https://cert.pl/en/posts/2024/06/CVE-2024-1228/
https://cert.pl/posts/2024/06/CVE-2024-1228/
https://dreryk.pl/produkty/gabinet/

Get alerted when CVE-2024-3699 or the next vulnerability affects your stack