{"id":"CVE-2026-118458","kind":"vulnerability","aliases":["CVE-2026-118458"],"related":[],"title":"CompuGroup Medical (CGM Italia) software ships hard-coded administrator logins via a test authentication path","description":"The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.","summary":"CompuGroup Medical's Italian healthcare software (AIS common login module) ships a test data access object with plaintext password comparison for application codes H and V in production, so fixed administrator accounts can log in without valid credentials. CSIRT Italia lists it as hard-coded credentials, CVSS 4.0 8.1. No exploitation or PoC is recorded as of 6 Nov 2026.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Venere","fixed":[],"affected":"<= 8.33.2","ecosystem":"vendor"},{"name":"Phronesis","fixed":[],"affected":"<= 4.51.0.1","ecosystem":"vendor"},{"name":"Wingesfar","fixed":["2026.07a"],"affected":"< 2026.07a","ecosystem":"vendor"},{"name":"XDent","fixed":[],"affected":"4.4.0","ecosystem":"vendor"},{"name":"XMedical","fixed":[],"affected":"4.4.0","ecosystem":"vendor"},{"name":"Infantia","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"},{"name":"Profim","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ais","compugroup-medical","hard-coded-credentials","healthcare","italy","java","other"],"not_affected_if":[],"how_to_check":"Find out which CGM product and version you run (XDent, XMedical, Wingesfar, Venere, Phronesis, Infantia, Profim) and compare with the list in the CSIRT Italia advisory. Fixed versions are not published, so ask CGM support whether the correction has been applied to your installation. Also check that the system is not reachable from the internet.","fix":"CGM says corrections were released with CSIRT Italia and are distributed automatically to affected installations. No fixed version number is published, except that Wingesfar 2026.07a is implied as the first unaffected release. Confirm with CGM customer service.","status":"open","published_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:17+00:00","updated_at":"2026-11-09T12:31:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T12:27:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"AIS login routing uses test DAO, accepts fixed administrator accounts","impact":"high","summary":"The shared AIS login routing selects a test data access object and plaintext password comparison for the H and V application codes, shipped in production. An attacker can log in with fixed administrator accounts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ais","java"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker logs in as administrator using fixed accounts","analyst_note":"Identify the affected AIS product and versions and whether a vendor fix or advisory exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118458.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":4501,"output_tokens":363,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected AIS product and versions and whether a vendor fix or advisory exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118458.","search":"'-118458':19A,22A '-2026':18A,21A '2026':101B '4.0':89B '6':99B '8.1':90B 'accept':124C 'access':55B 'account':72B,127C 'administr':10A,71B,126C 'ai':30B,47B,104C 'applic':62B,122C 'authent':15A 'cgm':3A 'code':9A,36B,63B,86B,123C 'common':48B 'comparison':60B,116C 'compugroup':1A,32B,41B 'compugroup-med':31B 'credenti':37B,78B,87B 'csirt':79B 'cve':17A,20A 'cvss':88B 'dao':113C 'data':54B 'exploit':92B 'fix':70B,125C 'h':64B,119C 'hard':8A,35B,85B 'hard-cod':7A,84B 'hard-coded-credenti':34B 'healthcar':38B,45B 'infantia':28A 'itali':39B 'italia':4A,80B 'italian':44B 'java':40B 'list':81B 'log':74B 'login':11A,49B,105C 'medic':2A,33B,42B 'modul':50B 'nov':100B 'object':56B 'password':59B 'path':16A 'phronesis':24A 'plaintext':58B,115C 'poc':94B 'product':68B,110C 'production-ship':109C 'profim':29A 'record':96B 'rout':106C 'select':107C 'share':103C 'ship':6A,51B,111C 'softwar':5A,46B 'test':14A,53B,112C 'v':66B,121C 'valid':77B 'venere':23A 'via':12A 'wingesfar':25A 'without':76B 'xdent':26A 'xmedical':27A","nicknames":[],"mitigations":[],"who_affected":"Practices, dental clinics and pharmacies in Italy running CGM products listed by CSIRT Italia: XDent 4.4.0, XMedical 4.4.0, Wingesfar before 2026.07a, Venere 8.33.2 and earlier, Phronesis 4.51.0.1 and earlier, Infantia 6.09.1 and earlier, Profim 6.09.1 and earlier. The advisory does not map versions to individual CVEs, so these apply to the advisory as a whole. NVD separately lists the cgm.it.ais.common package up to 5.1.15.1.1 for Venere and Phronesis. Others can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["infantia","phronesis","profim","venere","wingesfar","xdent","xmedical"],"ptokens":["infantia","phronesis","profim","venere","wingesfar","xdent","xmedical"],"labels":["ais","compugroupmedical","hardcodedcredentials","healthcare","high","italy","java","other"],"campaign_type":null,"search_a":"'-118458':19A,22A '-2026':18A,21A 'administr':10A 'authent':15A 'cgm':3A 'code':9A 'compugroup':1A 'cve':17A,20A 'hard':8A 'hard-cod':7A 'infantia':28A 'italia':4A 'login':11A 'medic':2A 'path':16A 'phronesis':24A 'profim':29A 'ship':6A 'softwar':5A 'test':14A 'venere':23A 'via':12A 'wingesfar':25A 'xdent':26A 'xmedical':27A","search_b":"'2026':101B '4.0':89B '6':99B '8.1':90B 'access':55B 'account':72B 'administr':71B 'ai':30B,47B 'applic':62B 'code':36B,63B,86B 'common':48B 'comparison':60B 'compugroup':32B,41B 'compugroup-med':31B 'credenti':37B,78B,87B 'csirt':79B 'cvss':88B 'data':54B 'exploit':92B 'fix':70B 'h':64B 'hard':35B,85B 'hard-cod':84B 'hard-coded-credenti':34B 'healthcar':38B,45B 'itali':39B 'italia':80B 'italian':44B 'java':40B 'list':81B 'log':74B 'login':49B 'medic':33B,42B 'modul':50B 'nov':100B 'object':56B 'password':59B 'plaintext':58B 'poc':94B 'product':68B 'record':96B 'ship':51B 'softwar':46B 'test':53B 'v':66B 'valid':77B 'without':76B","search_c":"'accept':124C 'account':127C 'administr':126C 'ai':104C 'applic':122C 'code':123C 'comparison':116C 'dao':113C 'fix':125C 'h':119C 'login':105C 'plaintext':115C 'product':110C 'production-ship':109C 'rout':106C 'select':107C 'share':103C 'ship':111C 'test':112C 'v':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118458","severity":null,"published_at":"2026-11-09T12:16:36+00:00","modified_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118458:2287","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T12:31:01+00:00","modified_at":"2026-11-09T12:31:01+00:00","first_seen_at":"2026-11-09T12:31:01+00:00","fetched_at":"2026-11-09T12:31:01+00:00","note":"Primary: CGM press release (patched, auto-distributed, no exploitation found) and CSIRT Italia advisory (products/versions, not per CVE; NVD version scheme differs). web-cli/Exa had no credits; used WebFetch. NVD page needed API JSON. X not checked. Nothing marked verified: CGM page names no versions or CVE.","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107410,"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","title":"CGM Italia: fixes distributed automatically, with CSIRT Italia","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}