CVE-2025-54459 — Vertikal Systems Hospital Manager Backend Services Exposure of Sensitive System Information to an Unauthorized Contro…

CVE-2025-54459

Vertikal Systems Hospital Manager Backend Services Exposure of Sensitive System Information to an Unauthorized Control Sphere PUBLISHED

Description (CNA)

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.

Affected (CNA)

Vendor / product	Versions
Vertikal Systems / Hospital Manager Backend Services	affected 0 through September 19, 2025

CWE

CWE-497

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.