A shared AIS login routing service mistakenly selects a production‑shipped test data access object and performs plaintext comparison on the H and V application codes. This flaw allows an attacker to authenticate with fixed, hard‑coded administrator credentials, thereby gaining unrestricted administrative access within the affected systems. The weakness stems from improper use of test credentials in a production environment, classified as CWE‑798.

The vulnerability affects CompuGroup Medical products Phronesis and Venere. No specific version range is listed in the CNA data, so all deployed instances may be susceptible until a vendor update is issued.

The CVSS score of 8.1 indicates a high severity, and the exploitability score (EPSS) is not available, suggesting uncertainty about current attack prevalence. The vulnerability is not listed in the CISA KEV catalog, but the presence of fixed administrative credentials creates an attractive attack vector. Likely exploitation would involve remote authentication against a publicly accessible AIS login endpoint, with minimal prerequisites beyond network connectivity.