Update components of multiple CompuGroup Medical products download and execute code without proper authenticity checks, relying on ignored hashes or forgeable checksums. Some update flows also allow archive traversal or script execution, creating a path for attackers to run arbitrary code on the target system. This flaw enables attackers to compromise confidentiality, integrity, and availability by installing malicious software, modifying clinical data, or hijacking system control.

The vulnerability affects CompuGroup Medical Infantia, Phronesis, Profim, and Venere. No specific version numbers are listed, so any installation of these products that uses the described update mechanism may be impacted.

The CVSS score of 9.2 indicates a critical vulnerability. While no EPSS score is available, the lack of an exploit probability figure does not mitigate the high risk inherent in the flaw. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the update mechanism itself; an adversary capable of supplying a malicious or tampered update—whether remotely through a compromised update server or locally by injecting updates—can gain full code execution privileges.