← Back to CVE Explorer

CVE-2026-118462

Full vulnerability record from the local CVENow database.

Description

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

Severity
CRITICAL
CVSS score
9.2 (v4.0)
Vulnerability status
Received
Source identifier
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
Published
2026-11-09 12:16:37.130000
Last modified
2026-11-09 12:16:37.130000
View original CVE JSON 
{
  "id": "CVE-2026-118462",
  "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
  "published": "2026-11-09T12:16:37.130",
  "lastModified": "2026-11-09T12:16:37.130",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution."
    }
  ],
  "affected": [
    {
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
      "affectedData": [
        {
          "vendor": "CompuGroup Medical",
          "product": "Infantia",
          "defaultStatus": "unknown",
          "packageName": "cgm.files.delivery",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Profim",
          "defaultStatus": "unknown",
          "packageName": "cgm.files.delivery",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Venere",
          "defaultStatus": "unknown",
          "packageName": "cgm.files.delivery",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Phronesis",
          "defaultStatus": "unknown",
          "packageName": "cgm.files.delivery",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Infantia",
          "defaultStatus": "unknown",
          "packageName": "cgm.liveupdates",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.12.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Profim",
          "defaultStatus": "unknown",
          "packageName": "cgm.liveupdates",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.12.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Venere",
          "defaultStatus": "unknown",
          "packageName": "cgm.liveupdates",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.12.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "CompuGroup Medical",
          "product": "Phronesis",
          "defaultStatus": "unknown",
          "packageName": "cgm.liveupdates",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.12.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.2,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-494"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical",
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"
    },
    {
      "url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html",
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"
    }
  ]
}