CVE-2025-54459: Vertikal Systems Hospital Manager Backend Services Exposure of Sensitive System Information to an Unauthorized Control Sphere

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-29 · updated 2026-10-08
Weakness: CWE-497

Description

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.

Affected products

Vertikal Systems Hospital Manager Backend Services: through 2025-09-19

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01

Get alerted when CVE-2025-54459 or the next vulnerability affects your stack