The vulnerability in InterSystems IRIS for Health allows transmitted data to be sent unencrypted, exposing sensitive information. The foremost consequence is an attacker being able to capture network traffic and read credentials or other confidential data, potentially enabling unauthorized device access. This weakness is classified as CWE-319, Cleartext Transmission of Sensitive Information.

The affected product is InterSystems IRIS for Health. No specific version information is provided; the default configuration of the system turns TLS/SSL encryption off. Users should verify their deployment follows the documented settings in the InterSystems IRIS superserver configuration.

The CVSS score of 9.2 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the default cleartext setting by intercepting network traffic where the IRIS superserver accepts non‑TLS connections. The likely attack vector is a local or remote network that can interact with the superserver port, allowing eavesdropping and credential theft. Given the high CVSS score and lack of mitigation by default, significant risk remains until TLS enforcement is applied.