CVE-2025-8306 - CVE House
Back to Database
Status published Medium CVE-2025-8306

Improper Access Control in Asseco Infomedica Plus

Vulnerability Description

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control.  Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8306

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Maciej Kazulak

References

More from Asseco

View All →
CVE-2025-8307
Recoverable passwords in Asseco Infomedica Plus
Medium 5.9
CVE-2025-4596
Information disclosure via IDOR in Asseco AMDX
Medium 5.3

Affected Vendor

Affected Software

InfoMedica Plus
Vulnerable Versions:
5.0.0, 4.0.0

Timeline

Official Publish: January 8th, 2026
Last Modified: January 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1220

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.