Hard-coded FTP credentials in KAMSOFT KS-SOMED software allowed attackers to upload…

Hard-coded FTP credentials in KAMSOFT KS-SOMED software allowed attackers to upload malicious updates that could be distributed to client machines.

CERT Polska coordinated disclosure of CVE-2026-42251, a vulnerability in KAMSOFT KS-SOMED software involving hard-coded credentials. An unauthorized attacker could use these embedded credentials to access the FTP server hosting application update packages. With this access, an attacker could upload malicious update files that would be distributed and installed on client machines as legitimate software updates, effectively compromising the software supply chain.

The vulnerability affected KS-SOMED modules KSPLUPDFTP.exe (versions up to 30.00.00.056) and ANEKSKLIENT.EXE (versions up to 29.00.02.026). The vendor has addressed the issue by removing hard-coded credentials from the codebase, modifying the update process, and restricting previously exposed credentials to read-only access.

This vulnerability represents a supply chain risk where trust in the legitimate update mechanism could be exploited to distribute malware. The issue was responsibly disclosed by security researcher Wojciech Giełda through CERT Polska's coordinated vulnerability disclosure process.

title: Suspicious Child Process from KS-SOMED Update Executable
id: 0068e2c7-73b6-5256-bc40-e4d4d737e810
status: experimental
description: 'Detects process creation events where KSPLUPDFTP.exe or ANEKSKLIENT.EXE
  (KAMSOFT KS-SOMED update modules affected by CVE-2026-42251) spawn command interpreters
  or scripting engines. These modules normally only apply signed update packages;
  a legitimate FTP credential compromise could allow an attacker to distribute a malicious
  update that executes arbitrary code through these binaries.

  '
references:
- CVE-2026-42251
author: Vorant
tags:
- attack.t1195.002
- attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \KSPLUPDFTP.exe
    - \ANEKSKLIENT.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Legitimate post-update maintenance scripts explicitly packaged and signed by KAMSOFT
  that invoke a shell for configuration purposes
level: high

title: Executable Dropped by KS-SOMED Update Process
id: 17169661-51f2-52ea-ba0b-703bcf1c9349
status: experimental
description: 'Detects file creation events where KSPLUPDFTP.exe or ANEKSKLIENT.EXE
  (KS-SOMED update modules affected by CVE-2026-42251) write new executable, DLL,
  or script files. Because the update FTP server used hard-coded credentials, an attacker
  could stage a malicious update package that these processes then write to disk during
  the normal update workflow.

  '
references:
- CVE-2026-42251
author: Vorant
tags:
- attack.t1195.002
- attack.initial-access
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \KSPLUPDFTP.exe
    - \ANEKSKLIENT.EXE
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .bat
    - .vbs
    - .hta
  filter:
    TargetFilename|contains:
    - \KAMSOFT\KS-SOMED\Update\
  condition: selection and not filter
falsepositives:
- Routine, vendor-signed KS-SOMED software updates writing new module binaries to
  the expected installation update directory
level: medium

title: FTP Network Connection Initiated by KS-SOMED Update Executable
id: f8f7f02b-a421-56a1-ab8e-7495460c30e5
status: experimental
description: 'Detects KSPLUPDFTP.exe or ANEKSKLIENT.EXE initiating outbound network
  connections on FTP ports (21/990). These executables use hard-coded default credentials
  (CVE-2026-42251) to reach the update FTP server; monitoring their FTP connections
  helps identify anomalous update-fetch activity such as connections to unexpected
  hosts or unusual timing outside scheduled maintenance windows (to be correlated
  by analysts, not encoded here).

  '
references:
- CVE-2026-42251
author: Vorant
tags:
- attack.t1078.001
- attack.defense-evasion
- attack.persistence
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \KSPLUPDFTP.exe
    - \ANEKSKLIENT.EXE
    DestinationPort:
    - 21
    - 990
  condition: selection
falsepositives:
- Scheduled, legitimate KS-SOMED update checks connecting to the vendor's official
  FTP update server during normal maintenance windows
level: low

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-42251