A flaw in e‑Sushrut HMIS allows an unauthenticated remote attacker to retrieve sensitive data and hard‑coded AES encryption keys from the client‑side JavaScript. By simply requesting the public code, an attacker can read protected information and compromise the system’s cryptographic protections, mapping to CWE‑321.

This vulnerability impacts earlier releases of CDAC‑Noida’s e‑Sushrut Hospital Management Information System that include the insecure client script; no specific version numbers are listed, so all past deployments with this code are potentially affected.

With a CVSS score of 8.7 the flaw is high severity and can be leveraged without authentication, allowing any user who loads the web interface to extract keys and confidential data. Although EPSS is unavailable and the issue is not in the CISA KEV catalog, the nature of the weakness suggests a realistic risk of data compromise.