The vulnerability resides in the Hospital Queuing Management system from Advantech, permitting unauthenticated remote attackers to query a specific URL and retrieve the API documentation. This exposure leaks potentially sensitive operational details and could be leveraged to glean service endpoints, authentication mechanisms, or configuration parameters. The weakness is classified as CWE-200, indicating a Sensitive Data Exposure flaw.

Affected systems include the Advantech Hospital Queuing Management application. The CVE specifically applies to installations running versions prior to HQM ISO 1.2.13 or QueueHttp.dll 1.2.12.7. All users of the current unpatched product are at risk, as the exposed endpoint is part of the standard installation without additional security controls.

The vulnerability has a CVSS score of 8.7, categorising it as high severity. Because the exploit requires no authentication and only a simple HTTP request, the likelihood of exploitation is relatively high, even though an EPSS score is not provided. The attack vector is likely to be a direct web request to the vulnerable URL. The vulnerability is not listed in the CISA KEV catalog, but timely remediation is recommended given the high CVSS score and straightforward exploit path.