Hard-coded creds threaten KlinikaXP update chain
A hard-coded credentials flaw in veterinary software KlinikaXP could have let attackers upload malicious updates to client machines via its FTP server.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-1958, a vulnerability in KlinikaXP and its companion app KlinikaXP Insertino, used by veterinary clinics to manage appointments, records, and finances. The flaw stems from hard-coded credentials embedded in the software, which granted unauthorized access to several internal services, including the FTP server hosting official update packages.
The practical risk was significant: an attacker with access to the exposed credentials could have uploaded a malicious update file to the FTP server, which would then be distributed and installed on client machines as a legitimate software update — a classic supply-chain compromise vector. The vendor has since removed the hard-coded credentials from the codebase and rotated the previously exposed credentials to prevent further exploitation attempts.
The issue affects KlinikaXP versions before 5.39.01.01 and KlinikaXP Insertino versions before 3.1.0.1. There is no indication in the advisory that this vulnerability was actively exploited in the wild; it was reported responsibly by researcher Wojciech Giełda and resolved through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Suspicious FTP Credential Usage from Software Update Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects FTP connections with embedded or hard-coded credentials from legitimate software update/installer processes - indicates potential supply-chain compromise or credential misuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious FTP Credential Usage from Software Update Process
description: Detects network connections to FTP servers using embedded credentials
from software update, installer, or patch management processes. Hard-coded credentials
in update mechanisms enable supply-chain compromise.
tags:
- attack.persistence
- attack.t1195.002
- attack.t1078
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \KlinikaXP.exe
- \KlinikaXPInsertino.exe
- \updater.exe
- \update.exe
DestinationPort: 21
Protocol: tcp
filter_interactive_user:
User|contains:
- INTERACTIVE
- CONSOLE
condition: selection and not filter_interactive_user
falsepositives:
- Legitimate FTP connections initiated by end-users for manual file transfer
- Update processes connecting to organization-controlled FTP servers with rotated
credentials
level: high
id: 95eb662c-82db-5570-9221-adbec358051b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-1958
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs