A flaw in the PicoTronica e-Clinic Healthcare System ECHS 5.7 file echs.js allows manipulation of the ADMIN_KEY argument to expose hard-coded credentials. This vulnerability can be exploited remotely and is actively documented, allowing an attacker to gain unauthorized access to the system and potentially sensitive medical data. The weakness is a classic example of hard-coded or weak credentials (CWE-259 and CWE-798), which directly compromises confidentiality and integrity of stored patient information.

The vulnerability affects PicoTronica e-Clinic Healthcare System ECHS version 5.7. The vendor has released a fixed version, 5.7.1, which removes the hard-coded credentials and mitigates the issue.

The CVSS score of 6.9 indicates a moderate to high severity, while the EPSS score is not available, making the current exploit probability unknown. The vulnerability is not listed in the CISA KEV catalog, but remote exploitation is feasible through manipulating the ADMIN_KEY argument. Attackers could remotely send crafted requests to trigger the denied credentials logic and gain privileged access.