{"id":"CVE-2025-61959","state":"PUBLISHED","title":"Vertikal Systems Hospital Manager Backend Services Generation of Error Message Containing Sensitive Information","description":"Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode=\"Off\"', which could have facilitated reconnaissance by unauthenticated attackers.","publishedAt":"2025-10-29T21:54:51.533Z","updatedAt":"2025-10-30T20:32:15.522Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Vertikal Systems Hospital Manager Backend Services"],"affected":[{"vendor":"Vertikal Systems","product":"Hospital Manager Backend Services","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"September 19, 2025","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01","https://www.vertikalsystems.com/en/products/pm/contact.php"],"weaknesses":["CWE-209"],"ingestedAt":"2026-10-29T20:09:48.677Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/61xxx/CVE-2025-61959.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-61959","state":"PUBLISHED","datePublished":"2025-10-29T21:54:51.533Z","dateUpdated":"2025-10-30T20:32:15.522Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-10-08T22:13:45.428Z"},"containers":{"cna":{"title":"Vertikal Systems Hospital Manager Backend Services Generation of Error Message Containing Sensitive Information","descriptions":[{"lang":"en","value":"Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode=\"Off\"', which could have facilitated reconnaissance by unauthenticated attackers."}],"affected":[{"vendor":"Vertikal Systems","product":"Hospital Manager Backend Services","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"September 19, 2025","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01"},{"url":"https://www.vertikalsystems.com/en/products/pm/contact.php"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-209","description":"CWE-209 Generation of Error Message Containing Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-10-29T21:54:51.533Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:vertikal_systems:hospital_manager_backend_services:*:*:*:*:*:*:*:*","versionEndIncluding":"september_19,_2025","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Pundhapat Sichamnong reported these vulnerabilities to CISA."}],"datePublic":"2025-10-28T17:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Vertikal Systems fixed these vulnerabilities by September 19, 2025. For more information, users should contact </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.vertikalsystems.com/en/products/pm/contact.php\">Vertikal Systems support</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;for assistance.</span>\n\n<br>"}],"value":"Vertikal Systems fixed these vulnerabilities by September 19, 2025. For more information, users should contact  Vertikal Systems support https://www.vertikalsystems.com/en/products/pm/contact.php  for assistance."}],"source":{"advisory":"ICSMA-25-301-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.4.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-30T20:32:04.844198Z","id":"CVE-2025-61959","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-30T20:32:15.522Z"}}]}}}