Hard-coded creds threaten KlinikaXP update chain
A hard-coded credentials flaw in veterinary software KlinikaXP could have let attackers upload malicious updates to client machines via its FTP server.
CERT Polska coordinated disclosure of CVE-2026-1958, a vulnerability in KlinikaXP and its companion app KlinikaXP Insertino, used by veterinary clinics to manage appointments, records, and finances. The flaw stems from hard-coded credentials embedded in the software, which granted unauthorized access to several internal services, including the FTP server hosting official update packages.
The practical risk was significant: an attacker with access to the exposed credentials could have uploaded a malicious update file to the FTP server, which would then be distributed and installed on client machines as a legitimate software update — a classic supply-chain compromise vector. The vendor has since removed the hard-coded credentials from the codebase and rotated the previously exposed credentials to prevent further exploitation attempts.
The issue affects KlinikaXP versions before 5.39.01.01 and KlinikaXP Insertino versions before 3.1.0.1. There is no indication in the advisory that this vulnerability was actively exploited in the wild; it was reported responsibly by researcher Wojciech Giełda and resolved through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Suspicious FTP Credential Usage from Software Update Process
Detects FTP connections with embedded or hard-coded credentials from legitimate software update/installer processes - indicates potential supply-chain compromise or credential misuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious FTP Credential Usage from Software Update Process
description: Detects network connections to FTP servers using embedded credentials
from software update, installer, or patch management processes. Hard-coded credentials
in update mechanisms enable supply-chain compromise.
tags:
- attack.persistence
- attack.t1195.002
- attack.t1078
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \KlinikaXP.exe
- \KlinikaXPInsertino.exe
- \updater.exe
- \update.exe
DestinationPort: 21
Protocol: tcp
filter_interactive_user:
User|contains:
- INTERACTIVE
- CONSOLE
condition: selection and not filter_interactive_user
falsepositives:
- Legitimate FTP connections initiated by end-users for manual file transfer
- Update processes connecting to organization-controlled FTP servers with rotated
credentials
level: high
id: 95eb662c-82db-5570-9221-adbec358051b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-1958
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free