Cryptographic Vulnerability in Compugroup Medical Products
CVE-2026-118464

5.8MEDIUM

Key Information:

Vendor

Compugroup Medical

Status
Infantia
Profim
Venere
Phronesis
Vendor
CVE Published:
9 November 2026

What is CVE-2026-118464?

The vulnerability involves shared cryptographic services that inadequately protect sensitive data by utilizing fixed vendor-wide secrets, deterministic initialization vectors (IVs), null salts, and reversible transformations. This flaw allows potential exposure of credentials, inter-process communication (IPC) data, configuration values, and critical clinical information, thereby jeopardizing data integrity and security.

Affected Version(s)

Infantia 0 <= 5.1.1

Phronesis 0 <= 5.1.1

Profim 0 <= 5.1.1

References

https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-i...
https://www.cgm.com/ita_it/magazine/articles/comunicati-s...

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Sala
CSIRT-IT
ApoCert srl
.