The vulnerability arises from hard‑coded credentials embedded in KlinikaXP and KlinikaXP Insertino. These credentials grant an attacker unauthorised access to multiple internal services, notably the FTP server that stores the application’s update packages. An attacker who obtains these credentials can upload a malicious update file to that FTP server. If clients download and install the compromised update, the attacker effectively injects malicious code into all affected systems, compromising confidentiality, integrity, and availability.

The affected products are BRI’s KlinikaXP and KlinikaXP Insertino. Versions prior to 5.39.01.01 of KlinikaXP and prior to 3.1.0.1 of KlinikaXP Insertino are vulnerable. All later releases contain remediation that removes the hard‑coded credentials and rotates any exposed passwords.

The CVSS score of 8.7 classifies this as a high‑severity issue. EPSS data are currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves the attacker gaining network or local access to the internal services and then using the hard‑coded credentials to authenticate to the FTP server. Once authenticated, the attacker can upload a malicious update, which clients may inadvertently install. This scenario offers a straightforward exploitation route with severe potential impact, especially if the update mechanism lacks integrity checks.