Technical impact
The vulnerability arises from hard‑coded default credentials in the RabbitMQ Management interface module of Roche Diagnostics navify Digital Pathology. Attackers who discover the exposed interface can use the default credentials, inferred from the description, to log in without any prior authorization, giving them full administrative control over the digital pathology environment. This allows configuration changes, data export, and other privileged actions. The weakness is cataloged as CWE‑1392, a credential management issue.
Affected Systems
Infected installations use Roche Diagnostics navify Digital Pathology versions 2.0.0 through 2.4.0 inclusive. The defect resides in the RabbitMQ Management interface modules, which are present by default in factory builds. Any system that has not applied the password change or disabled the guest account remains vulnerable.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity vulnerability. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. Exploitation is possible via direct remote access to the RabbitMQ Management interface over the network when the default credentials remain unchanged. Because the login values are widely known, only network visibility and misconfiguration are required to take advantage of the weakness, representing a significant risk for exposed or inadequately protected environments.
