CVE-2025-4596

Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 version of ADMX.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/01/CVE-2025-4596

Configurations

No configuration.

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El sistema Asseco ADMX se utiliza para el procesamiento de registros médicos. Permite a los usuarios autenticados acceder a archivos médicos pertenecientes a otros usuarios mediante la manipulación de argumentos GET que contienen ID de documento. Este problema ha sido corregido en la versión 6.09.01.62 de ADMX.

Information

Published : 2026-01-08 15:15

Updated : 2026-10-07 09:10

NVD link : CVE-2025-4596

Mitre link : CVE-2025-4596

CVE.ORG link : CVE-2025-4596

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-4596", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4596", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:36:12.890340Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Asseco", "product": "AMDX", "versions": [{"status": "affected", "version": "0", "lessThan": "6.09.01.62", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-08T15:15:43.333", "references": [{"url": "https://cert.pl/en/posts/2026/01/CVE-2025-4596", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs.\nThis issue has been fixed in 6.09.01.62 version of ADMX."}, {"lang": "es", "value": "El sistema Asseco ADMX se utiliza para el procesamiento de registros m\u00e9dicos. Permite a los usuarios autenticados acceder a archivos m\u00e9dicos pertenecientes a otros usuarios mediante la manipulaci\u00f3n de argumentos GET que contienen ID de documento. Este problema ha sido corregido en la versi\u00f3n 6.09.01.62 de ADMX."}], "lastModified": "2026-10-07T09:10:00.160", "sourceIdentifier": "cvd@cert.pl"}