A vulnerability in the application permits the derivation of an emergency password from publicly available source code. The derived password can be used to log in without any legitimate credentials, effectively bypassing the authentication mechanism. Because the attacker can authenticate, they gain the same permissions as a valid user, enabling potential compromise of sensitive data or system functions. The weakness is classified as CWE‑640, indicating the use of hard‑coded or easily derived credentials.

The flaw affects CompuGroup Medical products Infantia, Phronesis, Profim, and Venere. No specific affected versions are provided in the available information.

The CVSS score of 6.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, so the probability of exploitation is unclear. Based on the description, the likely attack vector is remote via the web interface where the emergency password can be derived without any legitimate credentials. An attacker who can access the application code and observe the time‑dependent logic can generate the password and authenticate as any user.