CVE-2026-118462 PUBLISHED

AIS update mechanism executes unverified code

Assigner: ENISA
Reserved: 28.10.2026 Published: 09.11.2026 Updated: 09.11.2026

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Product Status

Vendor CompuGroup Medical
Product Infantia
Versions Default: unknown
  • affected from 0 to 1.3.0 (incl.)
Vendor CompuGroup Medical
Product Profim
Versions Default: unknown
  • affected from 0 to 1.3.0 (incl.)
Vendor CompuGroup Medical
Product Venere
Versions Default: unknown
  • affected from 0 to 1.3.0 (incl.)
Vendor CompuGroup Medical
Product Phronesis
Versions Default: unknown
  • affected from 0 to 1.3.0 (incl.)
Vendor CompuGroup Medical
Product Infantia
Versions Default: unknown
  • affected from 0 to 2.12.0 (incl.)
Vendor CompuGroup Medical
Product Profim
Versions Default: unknown
  • affected from 0 to 2.12.0 (incl.)
Vendor CompuGroup Medical
Product Venere
Versions Default: unknown
  • affected from 0 to 2.12.0 (incl.)
Vendor CompuGroup Medical
Product Phronesis
Versions Default: unknown
  • affected from 0 to 2.12.0 (incl.)

Credits

  • Marco Sala finder
  • CSIRT-IT coordinator
  • ApoCert srl finder

References

Problem Types

  • CWE-494 CWE