Hospital Manager Backend CVE-2025-54459

Exploitation requires that the ASP.NET application be deployed with tracing enabled and the /trace.axd handler reachable and unauthenticated (localOnly disabled / trace enabled in configuration) - the default-insecure condition this CVE describes for Hospital Manager Backend Services prior to the September 19, 2025 fix. No authentication, user interaction, or special client tooling is needed (PR:N/UI:N/AC:L): a single HTTP request to /trace.axd suffices. The primary limiting factor is reachability - the endpoint must be network-exposed rather than firewalled or restricted to localhost - and the fact that a remediated/patched instance (where tracing is disabled or trace.axd is locked down) is not vulnerable.

This is a genuine, high-confidence information-disclosure issue rather than a theoretical high-CVSS inflation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity access with no user interaction and high confidentiality impact (VC:H) but no integrity or availability impact - which aligns cleanly with the description: an exposed ASP.NET /trace.axd endpoint leaking live request traces. The reporting source is CISA ICS-CERT (ics-cert@hq.dhs.gov) via an ICS Medical Advisory, lending vendor/government credibility to the finding. However, several exploitation signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no POC indicator provided, so active or widespread exploitation cannot be asserted - no public exploit identified at time of analysis. The practical risk is moderated by prevalence: this is a niche healthcare backend product, not ubiquitous infrastructure, so exploitation is likely targeted rather than mass-scanned, despite the trivial technical barrier. The leaked data (session identifiers, authorization headers) is a strong stepping stone to session hijacking or follow-on authenticated attacks, which raises real-world concern beyond pure 'info disclosure.' Net: a credible priority for affected healthcare operators, but EPSS/KEV/POC data is absent and should be confirmed before assuming broad exploitation.

A remote, unauthenticated attacker who can reach the application over the network requests the /trace.axd endpoint and receives live ASP.NET request traces containing session identifiers, authorization headers, server variables, and internal file paths. The attacker harvests a valid session token or authorization header from the trace and replays it to impersonate a legitimate user or pivot to deeper authenticated functionality. No public exploit code is identified, but exploitation requires only a standard HTTP GET and no special tooling.