CVE-2026-42518

This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.

CVSS

No CVSS.

References

Link	Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207

Configurations

No configuration.

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Esta vulnerabilidad existe en e-Sushrut debido a la divulgación de información sensible y a claves de cifrado AES codificadas de forma rígida en el JavaScript del lado del cliente. Un atacante remoto no autenticado podría explotar esta vulnerabilidad al acceder al código del lado del cliente para extraer información sensible y claves criptográficas. La explotación exitosa de esta vulnerabilidad podría llevar a la exposición de datos sensibles y al compromiso de las protecciones criptográficas en el sistema objetivo.

Information

Published : 2026-04-29 09:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-42518

Mitre link : CVE-2026-42518

CVE.ORG link : CVE-2026-42518

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2026-42518", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42518", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-29T12:02:47.874493Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vdisclose@cert-in.org.in", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vdisclose@cert-in.org.in", "affectedData": [{"vendor": "CDAC-Noida", "product": "e-Sushrut, Hospital Management Information System (HMIS)", "versions": [{"status": "affected", "version": "Previous versions", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-29T09:16:25.047", "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207", "source": "vdisclose@cert-in.org.in"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vdisclose@cert-in.org.in", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys.\n\nSuccessful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system."}, {"lang": "es", "value": "Esta vulnerabilidad existe en e-Sushrut debido a la divulgaci\u00f3n de informaci\u00f3n sensible y a claves de cifrado AES codificadas de forma r\u00edgida en el JavaScript del lado del cliente. Un atacante remoto no autenticado podr\u00eda explotar esta vulnerabilidad al acceder al c\u00f3digo del lado del cliente para extraer informaci\u00f3n sensible y claves criptogr\u00e1ficas.\n\nLa explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda llevar a la exposici\u00f3n de datos sensibles y al compromiso de las protecciones criptogr\u00e1ficas en el sistema objetivo."}], "lastModified": "2026-10-26T20:10:00.160", "sourceIdentifier": "vdisclose@cert-in.org.in"}