CVE-2026-118792— Default ODBC credentials
Quick assessment
Affected
CompuGroup Medical Wingesfar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
默认凭据允许通过 AcuXDBC 进行访问。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118792
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Default ODBC credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Default credentials permit access through AcuXDBC.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1392
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| CompuGroup Medical | Wingesfar | 0 ~ 2026.07a | - |
|
II. Public POCs for CVE-2026-118792
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118792
请登录查看更多情报信息。
Other References for CVE-2026-118792 (2)
Same Patch Batch · CompuGroup Medical · 2026-11-09 · 16 CVEs total
| CVE-2026-118462 | 9.2 CRITICAL | AIS update mechanism executes unverified code |
| CVE-2026-112172 | 8.1 HIGH | Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure |
| CVE-2026-118458 | 8.1 HIGH | AIS shared test login provider contains fixed administrative credentials |
| CVE-2026-118461 | 8.0 HIGH | AIS PersonnelService client performs unauthenticated doctor-specific operations |
| CVE-2026-118460 | 8.0 HIGH | AIS embedded private keys enable practitioner impersonation |
| CVE-2026-118468 | 7.2 HIGH | AIS XML parsers allow external entity resolution |
| CVE-2026-118791 | 7.2 HIGH | Insecure software update mechanism |
| CVE-2026-118790 | 7.2 HIGH | Multiple Hardcoded Credentials |
| CVE-2026-118459 | 6.3 MEDIUM | AIS PasswordSOS permits authentication without legitimate credentials |
| CVE-2026-118450 | 5.9 MEDIUM | Venere loads replaceable unsigned components from a writable installation location |
| CVE-2026-118795 | 5.9 MEDIUM | AIS stores authorization state in locally modifiable databases |
| CVE-2026-118464 | 5.8 MEDIUM | AIS shared cryptographic services use fixed cryptographic secrets |
| CVE-2026-118465 | 5.8 MEDIUM | AIS products use vendor-wide hard-coded database credentials |
| CVE-2026-118798 | 4.4 MEDIUM | Multiple sensitive authentication data exposed |
| CVE-2026-118467 | 4.3 MEDIUM | AIS products expose clinical and personal data via logs and telemetry |
IV. Related Vulnerabilities
Same vendor: CompuGroup Medical
-
CVE-2026-118798
Multiple sensitive authentication data exposed -
CVE-2026-118795
AIS stores authorization state in locally modifiable databas -
CVE-2026-118791
Insecure software update mechanism -
CVE-2026-118790
Multiple Hardcoded Credentials -
CVE-2026-118468
AIS XML parsers allow external entity resolution
Same weakness: CWE-1392
-
CVE-2026-123553
OpenAM before 16.1.4 Default Credentials in Built-in Account -
CVE-2026-123998
Hisense VIDAA Smart TV MQTT Broker Authentication Bypass -
CVE-2026-94459
IRISPowerscan Default accounts with predictable credentials -
CVE-2026-112354
Etrel INCH AC Charging Station Hard-coded Default Credential -
CVE-2026-22105
Use of default password based on serial number