What’s Vulnerable › Vulnerabilities

CVE-2024-50593: Hardcoded Service Password

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-08 · updated 2026-06-17
• Weakness: CWE-798

Description

An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.

Affected products

• HASOMED Elefant: before 24.03.03 — fixed in 24.03.03

How to fix

Upgrade to a fixed version: HASOMED Elefant 24.03.03. Check the vendor advisory for mitigations.

References

• https://hasomed.de/produkte/elefant/
• https://r.sec-consult.com/hasomed
• http://seclists.org/fulldisclosure/2024/Nov/3

Get alerted when CVE-2024-50593 or the next vulnerability affects your stack