Hasomed

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Hasomed product.

RSS Feeds for Hasomed security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Hasomed products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Hasomed Sorted by Most Security Vulnerabilities since 2018

Hasomed Elefant4 vulnerabilities

Hasomed Elefant Software Updater2 vulnerabilities

By the Year

In 2026 there have been 0 vulnerabilities in Hasomed. Hasomed did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	6	7.95

It may take a day or so for new Hasomed vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Hasomed Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-50592	Nov 08, 2024	Elefant Update Service Race Condition Privilege Escalation An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes. In addition, instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over to the user writable installation folder (C:\Elefant1). This means that a user can overwrite either "PostESUUpdate.exe" or "Update_OpenJava.exe" in the time frame after the copy and before the execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".	Elefant Software Updater
CVE-2024-50589	Nov 08, 2024	FHIR API EHR Exposure via Local Network An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR).	Elefant
CVE-2024-50590	Nov 08, 2024	Elefant Privilege Escalation via Service Binary Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as NT AUTHORITY\SYSTEM. Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".	Elefant
CVE-2024-50591	Nov 08, 2024	Elefant Update Service Command Injection Privilege Escalation An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The command injection can be exploited by communicating with the Elefant Update Service which is running as "SYSTEM" via Windows Named Pipes.The Elefant Software Updater (ESU) consists of two components. An ESU service which runs as "NT AUTHORITY\SYSTEM" and an ESU tray client which communicates with the service to update or repair the installation and is running with user permissions. The communication is implemented using named pipes. A crafted message of type "MessageType.SupportServiceInfos" can be sent to the local ESU service to inject commands, which are then executed as "NT AUTHORITY\SYSTEM".	Elefant Software Updater
CVE-2024-50593	Nov 08, 2024	Elefant Service v1.0 Hard-Coded Password Bypass An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.	Elefant
CVE-2024-50588	Nov 08, 2024	Elefant Firebird Default Credential RCE An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enables an attacker to create and overwrite arbitrary files on the server filesystem with the rights of the Firebird database ("NT AUTHORITY\SYSTEM").	Elefant