CVE-2026-42251

Hard-coded credentials in KS-SOMED

Published Jun 1, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.

This issue affects KS-SOMED with modules: KSPLUPDFTP.exe up to 30.00.00.056 and ANEKSKLIENT.EXE up to 29.00.02.026

Beside removing the hard-coded credentials from the code and changing the update process, access granted by previously exposed credentials was limited to read-only.

Analysis

Technical impact

Hard‑coded credentials within KS‑SOMED enable an attacker to reach the FTP server that hosts update packages. With these credentials an attacker can upload a malicious update file, which may then be distributed to client machines and installed as a legitimate update. The weakness is a classic authentication flaw (CWE‑798) that potentially allows remote code execution on clients receiving the tampered update.

Affected Systems

The vulnerability affects KAMSOFT KS‑SOMED applications. Specifically, the KSPLUPDFTP.exe module up to version 30.00.00.056 and the ANEKSKLIENT.EXE module up to version 29.00.02.026 are impacted.

Risk and Exploitability

The CVSS score of 8.7 marks this issue as a high‑severity vulnerability. Although no EPSS score is available, the presence of hard‑coded credentials makes exploitation highly likely if an attacker can reach the FTP service. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is direct FTP traffic from environments that can reach the server; once the embedded credentials are used, the attacker can upload files and trigger code execution on downstream client systems.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

KAMSOFT

KS-SOMED

unknown

Version	Status	Constraints
`0`	affected	≤ 30.00.00.056

KAMSOFT

KS-SOMED

unaffected

Version	Status	Constraints
`0`	affected	≤ 29.00.02.026

No data.

Vendor Product Versions

Kamsoft

Ks-somed

Version	Status	Scheme	Platform
`[0,30.00.00.056]`	affected	generic	—

Kamsoft

Ks-somed

Version	Status	Scheme	Platform
`[0,29.00.02.026]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade KS‑SOMED to a patched release that removes hard‑coded credentials and revokes read‑only restrictions on the FTP service.
Replace embedded credentials with secure authentication mechanisms and routinely rotate any system accounts.
Enhance the update deployment process by enforcing digital signatures, cryptographic checksums, and continuous monitoring for anomalous upload activity.
As a temporary measure, restrict external FTP access or add firewall rules to limit which IPs can connect to the update service.

Generated by OpenCVE AI on June 1, 2026 at 16:24 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.356% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cert.pl/posts/2026/06/CVE-2026-1958
https://kamsoft.pl/ks-somed/

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kamsoft Kamsoft ks-somed
Vendors & Products		Kamsoft Kamsoft ks-somed

Jun 1, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update. This issue affects KS-SOMED with modules: KSPLUPDFTP.exe up to 30.00.00.056 and ANEKSKLIENT.EXE up to 29.00.02.026 Beside removing the hard-coded credentials from the code and changing the update process, access granted by previously exposed credentials was limited to read-only.
Title		Hard-coded credentials in KS-SOMED
Weaknesses		CWE-798
References		https://cert.pl/posts/2026/06/CVE-2026-1958 https://kamsoft.pl/ks-somed/
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`