CVE-2024-50593: Hardcoded Service Password

Published Nov 8, 2024

Updated

An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.

Affected Software

1 affected component

Elefant Elefant Service tool

Remediation

Information

The vendor fixed the issue in version 24.03.03 (or higher) which can be downloaded from hasomed.de/produkte/elefant/ https://hasomed.de/produkte/elefant/ or via the Elefant Software Updater.

Event History

Nov 8, 2024

CVE Published

via MITRE·12:06 PM

Data Sourced

via MITRE·12:06 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-50593?

CVE-2024-50593 is considered a high severity vulnerability due to the potential for local exploitation.

How do I fix CVE-2024-50593?

To remedy CVE-2024-50593, it is essential to update the Elefant Service tool to the latest version that mitigates the hard-coded password issue.

Who is affected by CVE-2024-50593?

CVE-2024-50593 affects users of the Elefant Service tool, particularly in medical office environments with local access controls.

What type of access can be gained through CVE-2024-50593?

CVE-2024-50593 allows an attacker with local access to exploit restricted functions accessible via a hard-coded password.

Is there a workaround for CVE-2024-50593?

Currently, the best workaround for CVE-2024-50593 is to restrict physical access to systems running the Elefant Service tool until a patch is applied.