CVE-2025-54459
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.
Vendor
Product
CWE
Yayın Tarihi
2025-10-29 22:15:40
Güncelleme
2025-11-06 19:21:29
Source Identifier
ics-cert@hq.dhs.gov
KEV Date Added
-