The vulnerability arises from the use of weak or unprotected password hashing in older MEONA releases. Prior to 2024.10, passwords were stored with SHA‑1 or plain text, which constitutes insufficient computational effort. A super‑administrator can read or export these stored values from the client user administration or database functions. Consequently, an attacker who super‑administrator or database access can obtain raw password values, compromising confidentiality and potentially enabling further attacks against the hospital’s systems.

Mesalvo MEONA Server and MEONA Client are affected. Versions 2024.10, 2025.04, and 2026.03 are vulnerable for user accounts whose password was last set before the 2024.10 release, because those passwords may still be stored with SHA‑1 or unprotected. Accounts authenticated through an external directory service are not affected; only locally managed accounts are impacted.

The CVSS score of 4.4 classifies this flaw as low to moderate severity. The EPSS score is under 1 %, indicating that, while the issue exists, the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires super‑administrator privileges in MEONA or direct database access from within the hospital’s isolated network. Because MEONA runs exclusively in closed hospital networks and access to the administrative interface is typically limited to internal staff, the practical risk remains limited but not negligible. Until the recommended service packs that remove legacy storage methods are applied, organizations should consider the possibility of password exposure should an insider or compromised administrative account obtain elevated privileges.