CVE-2026-8031mediumCWE-287CWE-306

CVE-2026-8031: medium-severity vulnerability in PicoTronica e-Clinic Healthcare System ECHS

PicoTronica e-Clinic Healthcare System ECHS API Endpoint patient-records missing authentication

Published

Follow this CVE+ Monitor e-Clinic Healthcare System ECHS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.4%
A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/patient-records of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 5.7.1 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
PicoTronica · e-Clinic Healthcare System ECHS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PicoTronica e-Clinic Healthcare System ECHS

In the same product, most dangerous first.

CVE-2026-8033MEDIUMPicoTronica e-Clinic Healthcare System ECHS Response Header v2 information disclosureEPSS 0.3%CVE-2026-8032MEDIUMPicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentialsEPSS 0.3%