A missing authentication check in the e-Clinic Healthcare System API endpoint /cdemos/echs/api/v2/patient-records allows an attacker to request and retrieve patient records without credentials. This induces a full authentication bypass, enabling unauthorized access to sensitive health information and privacy violations. The weakness corresponds to CWE-287 (Authentication Failure) and CWE-306 (Missing Authentication). The attack can be performed over the network and is reported as publicly exploitable.

PicoTronica’s e-Clinic Healthcare System (ECHS) version 5.7 is affected. The vendor has issued version 5.7.1 as a fix, which removes the unauthenticated access flaw. No other versions are listed as impacted.

The CVSS score of 6.9 indicates moderate risk, with the potential for non‑repudiation and confidentiality loss. EPSS data is not available, so the exploit probability is unknown, but the vulnerability is publicly disclosed and may be used by attackers. The issue is not listed in CISA’s KEV catalog, yet the exploitation vector is remote and does not require local privileges. Organizations running ECHS 5.7 should treat this as a moderate‑to‑high risk condition until the patch is applied.