Which versions of e-Sushrut HMIS are affected by CVE-2026-42514?

C-DAC's e-Sushrut Hospital Management Information System (HMIS) contains a critical authentication bypass vulnerability (CVE-2026-42514, CVSS 8.8) where one-time passwords are exposed in plaintext…

How to fix or mitigate CVE-2026-42514?

Within 24 hours, conduct a security assessment to identify all API endpoints exposing OTPs and contact C-DAC directly for patch status and vendor interim guidance; enable enhanced API request and response logging for forensic review of any suspected compromise. Within 7 days, implement mandatory HTTPS/TLS encryption for all API communications with strong cipher suites if not already enforced, deploy API-level monitoring to detect anomalous OTP generation or reuse patterns, segment network access to the HMIS API using firewall rules to restrict exposure, and reduce OTP validity window to the minimum operationally feasible duration (typically 5-10 minutes). Within 30 days, continue coordination with C-DAC for an official vendor patch, conduct comprehensive forensic audit of authentication logs for indicators of account compromise, and evaluate infrastructure-level controls such as API gateways or Web Application Firewalls capable of filtering or masking sensitive data in responses before transmission.

e-Sushrut HMIS CVE-2026-42514

Q: What is the CVSS score of CVE-2026-42514?

CVE-2026-42514 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-26197 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-04-29 CERT-In

Authentication Bypass E Sushrut Hospital Management Information System Hmis Cdac Noida

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Aligned with CERT-In's AV:N/PR:N; OTP exposure yields C:H and account access enables limited data change (I:L), no availability impact; AC:L retained though interception position may warrant AC:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:34 vuln.today

CVSS changed

Apr 29, 2026 - 09:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 08:30 euvd

EUVD-2026-26197

CVE Published

Apr 29, 2026 - 08:17 nvd

HIGH 8.8

DescriptionCVE.org

This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs.

Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unauthorized access to user accounts on the targeted system.

AnalysisAI

Account takeover in C-DAC's e-Sushrut Hospital Management Information System (HMIS) arises because one-time passwords (OTPs) are returned in plaintext inside API responses, letting a remote attacker who can observe those responses harvest a valid OTP and impersonate the targeted user. CERT-In flagged the flaw (CIVN-2026-0207) and it is tagged as an authentication bypass; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.17%. The CVSS 4.0 vector rates it 8.8 with high confidentiality impact and no privileges or user interaction required.

Technical ContextAI

e-Sushrut is a hospital management information system developed by C-DAC (Centre for Development of Advanced Computing), Noida, deployed primarily across Indian public and government healthcare facilities (CPE: cpe:2.3:a:cdac-noida:e-sushrut,_hospital_management_information_system_(hmis)). The root cause is CWE-319 (Cleartext Transmission/Exposure of Sensitive Information): the OTP, which is meant to be a secret second factor delivered out-of-band to the legitimate user, is instead echoed back in the body of an API response. Because the secret intended to prove possession of a channel (SMS/email) is present in the HTTP response itself, the entire OTP verification step collapses into a value an attacker can simply read, defeating the multi-factor / verification control it was designed to enforce.

RemediationAI

No vendor-released patch version is identified at time of analysis - the EUVD entry cites only 'Previous versions' without a fixed build - so organizations running e-Sushrut HMIS should contact C-DAC Noida directly and follow the CERT-In advisory CIVN-2026-0207 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207) for the patched release. The core fix is server-side: stop returning OTP values in any API response body and instead deliver OTPs only through the out-of-band channel (SMS/email) while returning a neutral success indicator. As compensating controls until patched, place API endpoints behind a WAF or API gateway rule that inspects and strips/blocks responses containing OTP-shaped fields (trade-off: requires knowing the exact field names and may need TLS inspection), enforce strict TLS and disable any plaintext HTTP listeners to reduce interception opportunity (trade-off: does not help if the OTP is exposed to a legitimate-but-malicious requester), and reduce OTP validity windows and add rate-limiting/lockout on OTP verification to shrink the exploitation window (trade-off: may impact usability for slow users). Refer also to https://vuldb.com/vuln/360103.