CVE-2026-8032

HIGH

PicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentials

Title source: cna

Description

A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. This manipulation of the argument ADMIN_KEY causes hard-coded credentials. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 5.7.1 is sufficient to resolve this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-361358 | PicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentials

https://vuldb.com/vuln/361358

Signature, Permissions Required signature permissions-required

VDB-361358 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/361358/cti

Third Party Advisory third-party-advisory

Submit #800792 | PicoTronica e-Clinic Healthcare System (ECHS) v5.7 Improper Privilege Management

https://vuldb.com/submit/800792

Exploit exploit

https://docs.google.com/document/d/1w1veNs8I3nxsVxbSiIgJmt-4S5a0rW0bvjDvEe7iDr0/edit?usp=sharing

Scores

CVSS v3 7.3

EPSS 0.0028

EPSS Percentile 19.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-259 CWE-798

Status published

Products (2)

PicoTronica/e-Clinic Healthcare System ECHS 5.7

PicoTronica/e-Clinic Healthcare System ECHS 5.7.1

Published May 06, 2026

Tracked Since May 07, 2026