CVE-2026-42251
Hard-Coded Credentials in KS-SOMED FTP Update Mechanism
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kamsoft | ks-somed | to 30.00.00.056 (inc) |
| kamsoft | ks-somed | to 29.00.02.026 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the use of hard-coded credentials in the KS-SOMED application, specifically in the modules KSPLUPDFTP.exe and ANEKSKLIENT.EXE. An unauthorized attacker could use these hard-coded credentials to access the FTP server that hosts the application's update packages.
With access to the FTP server, the attacker could upload a malicious update file. This malicious update might then be distributed and installed on client machines as if it were a legitimate update.
How can this vulnerability impact me? :
The impact of this vulnerability is significant because an attacker could distribute malicious software to client machines by uploading a compromised update file to the FTP server.
This could lead to unauthorized code execution on client systems, potentially compromising the confidentiality, integrity, and availability of the affected systems.
However, it is noted that access granted by the previously exposed credentials was limited to read-only, and the vulnerability was addressed by removing the hard-coded credentials and changing the update process.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing the hard-coded credentials from the KS-SOMED application code and changing the update process to prevent unauthorized access.
Since access granted by the previously exposed credentials was limited to read-only, it is important to revoke or change these credentials to prevent any further unauthorized access.