Hard‑coded credentials within KS‑SOMED enable an attacker to reach the FTP server that hosts update packages. With these credentials an attacker can upload a malicious update file, which may then be distributed to client machines and installed as a legitimate update. The weakness is a classic authentication flaw (CWE‑798) that potentially allows remote code execution on clients receiving the tampered update.

The vulnerability affects KAMSOFT KS‑SOMED applications. Specifically, the KSPLUPDFTP.exe module up to version 30.00.00.056 and the ANEKSKLIENT.EXE module up to version 29.00.02.026 are impacted.

The CVSS score of 8.7 marks this issue as a high‑severity vulnerability. Although no EPSS score is available, the presence of hard‑coded credentials makes exploitation highly likely if an attacker can reach the FTP service. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is direct FTP traffic from environments that can reach the server; once the embedded credentials are used, the attacker can upload files and trigger code execution on downstream client systems.