Asseco InfoMedica Plus password disclosure enables admin escalation
Asseco InfoMedica Plus healthcare management software fixed two chained vulnerabilities allowing low-privileged users to extract and decode passwords, enabling privilege escalation to administrator.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two critical vulnerabilities in Asseco InfoMedica Plus, a comprehensive healthcare management platform used for administrative and medical operations. CVE-2025-8306 permits low-privileged users to extract encoded passwords of other accounts, including the main administrator, due to insufficient access control granularity. CVE-2025-8307 involves insecure storage of user passwords in an encoded format within the database, where the decoding algorithm is embedded in the client-side application.
When chained together, these vulnerabilities enable a straightforward privilege escalation attack path: a low-privileged attacker can retrieve encoded administrator credentials via the access control flaw, then decode them using the client-side algorithm to gain full administrative access to the healthcare system. Both vulnerabilities have been remediated in versions 4.50.1 and 5.38.0.
The disclosure was handled responsibly through CERT Polska's coordinated vulnerability disclosure process, with credit to security researcher Maciej Kazulak for the initial report. Organizations running Asseco InfoMedica Plus should prioritize patching to the fixed versions immediately given the high risk of privilege escalation in healthcare environments where data sensitivity and system availability are critical.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-8306
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs