EUVD-2026-50439
GHSA-pr7r-jf2h-77g3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Publicly known default credentials give unauthenticated network access (PR:N/AV:N/AC:L), and WAR deployment yields full host code execution, so C/I/A are all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed the vulnerable finding.
AnalysisAI
Remote code execution in Care Everywhere Gateway 14.3.10 stems from hard-coded, install-invariant credentials in its bundled WildFly 8.2.0.Final management interface (port 20990), letting unauthenticated remote attackers log into the management console and deploy a malicious WAR to run code as the Windows machine account. The affected 14.x branch reached end-of-life in 2017 and later releases remediate the issue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the WildFly management console on TCP port 20990 of a Care Everywhere Gateway 14.3.10 host; no authentication, credentials, or user interaction are needed because the hard-coded management credentials are identical across all installations and publicly known. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to genuine, high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans healthcare-network hosts for TCP port 20990, connects to the exposed WildFly management console, and logs in using the publicly documented default credentials shared across all installations. Using the Deployments interface they upload a malicious JSP/WAR web shell, achieving remote code execution as the Windows machine account and a foothold on the health-information-exchange gateway. … |
| Remediation | The vendor indicates that releases after the end-of-life 14.x.x branch have addressed this finding, so the primary fix is to upgrade off 14.x to a current, supported release; no exact fixed version number is given in the available data, so confirm the target build with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Care Everywhere Gateway 14.3.10 instances in production and non-production environments, restrict network access to port 20990 via firewall rules (blocking external traffic), and enable security monitoring on these systems for suspicious WildFly console access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-1392 – Use of Default Credentials
View allShare
External POC / Exploit Code
Leaving vuln.today