by Kastro
Paper/Archive/CVE-2026-118462

CVE-2026-118462

CompuGroup Medical Infantia — AIS update mechanism executes unverified code

CVSS 9.2
critical.is priorityof 100
28
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

Affected

ProductAffectedFixed inSource
Infantia≤ 1.3.0–CNA
Profim≤ 1.3.0–CNA
Venere≤ 1.3.0–CNA
Phronesis≤ 1.3.0–CNA
Infantia≤ 2.12.0–CNA
Profim≤ 2.12.0–CNA
Venere≤ 2.12.0–CNA
Phronesis≤ 2.12.0–CNA

Scores by source

ENISA (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

refacn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medicalrefcgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html