The vulnerability is that AIS shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, inter-process communication data, configuration values and clinical fields. This weakness allows attackers to recover or replay cryptographic material, potentially decrypting sensitive data and exposing confidential information.

CompuGroup Medical products Infantia, Phronesis, Profim and Venere are affected. The vulnerability resides in their shared cryptographic services and no specific version details are available from the CNA data.

The CVSS score of 5.8 places the vulnerability in the moderate range. EPSS information is not provided, so the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, indicating there is no known active exploitation. Likely attack vectors involve local or privileged access to the cryptographic services, or remote exploitation if service interfaces are exposed. Since the secret material is fixed and deterministic, an attacker who obtains any cryptographic artifact can derive the secret and decrypt data.