A flaw exists in the Response Header Handler of PicoTronica e-Clinic Healthcare System ECHS 5.7. The handler, invoked through requests to /cdemos/echs/api/v2/, fails to validate or control the content of HTTP response headers, allowing an attacker to induce the disclosure of sensitive data such as patient information or system configuration. This breach aligns with CWE-200 (Information Exposure) and CWE-284 (Improper Access Control), and can expose confidential data to unauthenticated parties.

The affected product is PicoTronica e-Clinic Healthcare System ECHS, version 5.7. The vulnerability resides in the Response Header Handler component handling API requests at /cdemos/echs/api/v2/. Upgrading the installation to version 5.7.1 removes the flaw.

The CVSS score of 6.9 classifies the vulnerability as moderate severity. The attack is remediable from a remote environment using standard HTTP requests, and the advisory confirms that the exploit is publicly disclosed. EPSS data is unavailable, so the exploitation likelihood cannot be quantified, while the vulnerability is not currently listed in the CISA KEV catalog. Despite the lack of documented large‑scale attacks, the information disclosure could allow attackers to obtain data, potentially serving as a foothold for further compromise.