Hospital Manager Backend CVE-2025-61959

Exploitation requires that the Hospital Manager Backend Services instance be deployed with 'customErrors mode="Off"' (the insecure configuration named in the description), causing the ASP.NET runtime to return verbose error pages for invalid WebResource.axd requests. The attacker needs network reachability to the application's HTTP endpoint but no authentication and no user interaction (PR:N/UI:N). Limiting factors: the disclosure is confined to framework/version metadata, stack traces, and internal paths (no sensitive application or patient data, no write capability), and the condition appears to have been remediated prior to September 19, 2025, so patched or correctly configured deployments (customErrors mode set to 'On' or 'RemoteOnly') are not exposed.

This is a low-to-moderate information-disclosure issue (CWE-209) that should be treated as reconnaissance-enabling rather than directly damaging. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is remotely reachable by unauthenticated attackers with low complexity, but the impact metrics (VC:L, VI:N, VA:N) correctly cap it: only low confidentiality impact, no integrity or availability effect. The base score of 6.9 overstates practical urgency because what leaks is environmental metadata (ASP.NET version, stack traces, internal paths, and the 'customErrors mode="Off"' misconfiguration) rather than credentials or sensitive patient data. No EPSS score is provided in the input, and the vulnerability is NOT in CISA KEV and has no associated POC - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The phrase 'Prior to September 19, 2025' in the description strongly implies the condition has already been remediated by the vendor, further reducing live risk. Net assessment: a genuine but low-priority hygiene finding whose main value to an attacker is accelerating reconnaissance ahead of a different, more impactful exploit. Reported by CISA ICS-CERT (ics-cert@hq.dhs.gov), so the finding is credible, but the signals (no KEV, no POC, low-only impact) all point to low real-world risk despite the 6.9 score.

An unauthenticated attacker on the network sends a malformed or invalid WebResource.axd request to the Hospital Manager Backend Services endpoint and receives a verbose ASP.NET error page in response. The returned stack traces, framework/version strings, and internal file paths let the attacker fingerprint the platform and map internal structure to plan a follow-on attack. No public exploit code is required or identified; the behavior is triggered with an ordinary crafted HTTP request.