CVE-2024-50588 - CVE House
Back to Database
Status published Unknown CVE-2024-50588

Unprotected Exposed Firebird Database with default credentials

Vulnerability Description

An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enables an attacker to create and overwrite arbitrary files on the server filesystem with the rights of the Firebird database ("NT AUTHORITY\SYSTEM").

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-50588

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Tobias Niemann, SEC Consult Vulnerability Lab
  • Daniel Hirschberger, SEC Consult Vulnerability Lab
  • Florian Stuhlmann, SEC Consult Vulnerability Lab

References

More from HASOMED

View All →
CVE-2024-50593
Hardcoded Service Password
Unknown 0
CVE-2024-50592
Local Privilege Escalation via Race Condition
Unknown 0
CVE-2024-50591
Local Privilege Escalation via Command Injection
Unknown 0
CVE-2024-50590
Local Privilege Escalation via Weak Service Binary Permissions
Unknown 0
CVE-2024-50589
Unprotected FHIR API
Unknown 0

Affected Vendor

Affected Software

Elefant
Vulnerable Versions:
<24.03.03

Timeline

Official Publish: November 8th, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-1393 CWE-419

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.