Shared components in certain CompuGroup Medical products store hard‑coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across all installations. These credentials are embedded in the software and exposed through the components, allowing an attacker to obtain the database usernames and passwords. Having those credentials enables the attacker to read or modify sensitive healthcare data stored in the databases, potentially compromising the confidentiality, integrity, and availability of patient information.

CompuGroup Medical Infantia, Phronesis, Profim, and Venere are affected by this vulnerability. Exact version numbers are not disclosed in the available data, but the issue affects all installations that include the shared components containing the hard‑coded credentials.

The CVSS score of 5.8 indicates a medium severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation at the time of analysis. The likely attack vector is local or remote system compromise that allows retrieval of the hard‑coded credentials from the component files or logs. Once obtained, an attacker could authenticate to the database with those credentials and perform privileged operations, thereby exposing or altering patient data.