MEDIUMCVSS v4 5.3Vulnerability
CVE-2026-113618
The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application. The issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).
Properties
- First seen
- 2026-11-06T17:45:13+00:00
- Cvss score
- 5.3
- Last seen
- 2026-11-06T17:45:13+00:00
- Euvd assigner
- CERT-PL
- Retrieved at
- 2026-11-07T06:41:39+00:00
- Src batch id
- euvd-20261106T193402Z-7033ca
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118269
- Score
- 5.3
- Euvd base score version
- 4.0
- Fetched at
- 2026-11-06T19:34:22+00:00
- Euvd vendor
- KAMSOFT
- Cvss vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- First seen by Signal
- 2026-11-06T18:25:35+00:00
- Euvd base score
- 5.3
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Content hash
- eb308702031b7dfc02e5b04a3756ca754521d8bc3b69373828e8f5a2985070b8
- Published at
- 2026-11-06T15:17:08.873
- Euvd updated
- 2026-11-06T17:45:13+00:00
- Last modified
- 2026-11-06T18:17:50.037
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph