The vulnerability resides in shared telemetry and logging components within various CompuGroup Medical AIS products. These components store or transmit patient and doctor identifiers, clinical information, and low‑entropy IDs without adequate pseudonymization or protection, enabling disclosure of protected health information.

Affected products include Infantia, Phronesis, Profim, and Venere from CompuGroup Medical. No precise version information is provided; all listed products are potentially impacted until a vendor release containing the fix is issued.

The CVSS score of 4.3 indicates a moderate severity. EPSS is unknown, and the issue is not listed in CISA KEV, implying no current known exploited instances. The likely attack vector is through the telemetry and logging mechanisms that may be accessible to users with system or network access; an attacker could capture log files or telemetry streams to exfiltrate patient identifiers and clinical data.