CVE-2026-42514

HIGH

Sensitive Data Exposure Vulnerability in e-Sushrut HMIS

Title source: cna

Description

This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs. Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unauthorized access to user accounts on the targeted system.

References (1)

[Third Party Advisory] https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207

Scores

CVSS v4 8.8

EPSS 0.0016

EPSS Percentile 37.2%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-319

Status published

Products (1)

CDAC-Noida/e-Sushrut, Hospital Management Information System (HMIS) Previous versions

Published Apr 29, 2026

Tracked Since Apr 29, 2026