KAMSOFT KS-SOMED exposes hard-coded FTP credentials
Hard-coded FTP credentials in KAMSOFT KS-SOMED software allowed attackers to upload malicious updates that could be distributed to client machines.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-42251, a vulnerability in KAMSOFT KS-SOMED software involving hard-coded credentials. An unauthorized attacker could use these embedded credentials to access the FTP server hosting application update packages. With this access, an attacker could upload malicious update files that would be distributed and installed on client machines as legitimate software updates, effectively compromising the software supply chain.
The vulnerability affected KS-SOMED modules KSPLUPDFTP.exe (versions up to 30.00.00.056) and ANEKSKLIENT.EXE (versions up to 29.00.02.026). The vendor has addressed the issue by removing hard-coded credentials from the codebase, modifying the update process, and restricting previously exposed credentials to read-only access.
This vulnerability represents a supply chain risk where trust in the legitimate update mechanism could be exploited to distribute malware. The issue was responsibly disclosed by security researcher Wojciech Giełda through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by KS-SOMED Update Modules
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects KSPLUPDFTP.exe or ANEKSKLIENT.EXE spawning script/shell interpreters, indicating a malicious update package executed via the compromised FTP-based update mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from KS-SOMED Update Executable
id: 0068e2c7-73b6-5256-bc40-e4d4d737e810
status: experimental
description: 'Detects process creation events where KSPLUPDFTP.exe or ANEKSKLIENT.EXE
(KAMSOFT KS-SOMED update modules affected by CVE-2026-42251) spawn command interpreters
or scripting engines. These modules normally only apply signed update packages;
a legitimate FTP credential compromise could allow an attacker to distribute a malicious
update that executes arbitrary code through these binaries.
'
references:
- CVE-2026-42251
author: Vorant
tags:
- attack.t1195.002
- attack.initial-access
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \KSPLUPDFTP.exe
- \ANEKSKLIENT.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Legitimate post-update maintenance scripts explicitly packaged and signed by KAMSOFT
that invoke a shell for configuration purposes
level: high
KS-SOMED Update Module Writing Executable Payload to Disk
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects KSPLUPDFTP.exe or ANEKSKLIENT.EXE writing new executable or script files to disk, which may represent a malicious update package delivered via compromised FTP credentials rather than a legitimate signed update. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable Dropped by KS-SOMED Update Process
id: 17169661-51f2-52ea-ba0b-703bcf1c9349
status: experimental
description: 'Detects file creation events where KSPLUPDFTP.exe or ANEKSKLIENT.EXE
(KS-SOMED update modules affected by CVE-2026-42251) write new executable, DLL,
or script files. Because the update FTP server used hard-coded credentials, an attacker
could stage a malicious update package that these processes then write to disk during
the normal update workflow.
'
references:
- CVE-2026-42251
author: Vorant
tags:
- attack.t1195.002
- attack.initial-access
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \KSPLUPDFTP.exe
- \ANEKSKLIENT.EXE
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .bat
- .vbs
- .hta
filter:
TargetFilename|contains:
- \KAMSOFT\KS-SOMED\Update\
condition: selection and not filter
falsepositives:
- Routine, vendor-signed KS-SOMED software updates writing new module binaries to
the expected installation update directory
level: medium
Outbound FTP Connection from KS-SOMED Update Executable
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects KSPLUPDFTP.exe or ANEKSKLIENT.EXE establishing outbound FTP connections, the mechanism abused via hard-coded default credentials to reach the update server hosting KS-SOMED packages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FTP Network Connection Initiated by KS-SOMED Update Executable
id: f8f7f02b-a421-56a1-ab8e-7495460c30e5
status: experimental
description: 'Detects KSPLUPDFTP.exe or ANEKSKLIENT.EXE initiating outbound network
connections on FTP ports (21/990). These executables use hard-coded default credentials
(CVE-2026-42251) to reach the update FTP server; monitoring their FTP connections
helps identify anomalous update-fetch activity such as connections to unexpected
hosts or unusual timing outside scheduled maintenance windows (to be correlated
by analysts, not encoded here).
'
references:
- CVE-2026-42251
author: Vorant
tags:
- attack.t1078.001
- attack.stealth
- attack.persistence
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \KSPLUPDFTP.exe
- \ANEKSKLIENT.EXE
DestinationPort:
- 21
- 990
condition: selection
falsepositives:
- Scheduled, legitimate KS-SOMED update checks connecting to the vendor's official
FTP update server during normal maintenance windows
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-42251
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs