Information Disclosure Vulnerability in e-Sushrut by eHealth Solutions
CVE-2026-42518

8.7HIGH

Key Information:

Vendor

Cdac-noida

Status
E-sushrut, Hospital Management Information System (hmis)
Vendor
CVE Published:
29 April 2026

What is CVE-2026-42518?

The e-Sushrut platform by eHealth Solutions is vulnerable to information disclosure due to hardcoded AES encryption keys found in client-side JavaScript. An unauthenticated remote attacker could exploit this flaw by accessing the client-side code, allowing them to extract sensitive information and cryptographic keys. This exploitation poses significant risks, potentially leading to unauthorized access to sensitive data and undermining the cryptographic security measures in place.

Affected Version(s)

e-Sushrut, Hospital Management Information System (HMIS) Previous versions

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability is reported by Harsh Verma
.