The vulnerability lies in e‑Sushrut’s API responses, where one‑time passwords are exposed in plaintext. An attacker who can observe these responses can capture valid OTPs, use them to impersonate the corresponding user, and gain unauthorized access to the victim’s account. This flaw falls under CWE‑319, Plaintext storage of sensitive information.

The affected product is CDAC Noida e‑Sushrut Hospital Management Information System (HMIS). All previous versions of the system are potentially impacted; no specific sub‑version details are available.

With a CVSS score of 8.8, this issue is considered high severity. The EPSS value is unavailable, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote network interception of API traffic; an attacker with network access between the client and server can capture the plaintext OTPs. No additional authentication or privileges are required beyond normal network connectivity, making exploitation relatively straightforward for a determined adversary.