Is there a public PoC exploit available for CVE-2026-8031?

Yes, a public proof-of-concept exploit is available for CVE-2026-8031. Prioritise patching immediately. EPSS: 0.0%.

PicoTronica e-Clinic Healthcare System CVE-2026-8031

Q: What is the CVSS score of CVE-2026-8031?

CVE-2026-8031 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28149 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-05-06 VulDB

Authentication Bypass E Clinic Healthcare System Echs

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 06, 2026 - 19:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

May 06, 2026 - 19:00 vuln.today

DescriptionCVE.org

A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/patient-records of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 5.7.1 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Missing authentication in PicoTronica e-Clinic Healthcare System ECHS 5.7 allows remote unauthenticated attackers to access the /cdemos/echs/api/v2/patient-records API endpoint and retrieve sensitive patient information. Publicly available exploit code exists for this vulnerability. The vendor released patched version 5.7.1 to address the issue.

Technical ContextAI

The vulnerability exists in the API endpoint /cdemos/echs/api/v2/patient-records within the ECHS component, which fails to enforce authentication controls before exposing patient record data. This is a classic authentication bypass flaw (CWE-306) affecting a REST API endpoint in a healthcare management system. The CPE indicates the vulnerability affects the PicoTronica e-Clinic Healthcare System ECHS product family across version 5.7 and earlier. The lack of authentication check means any network-connected attacker can directly invoke this endpoint without providing valid credentials or session tokens.

RemediationAI

Upgrade PicoTronica e-Clinic Healthcare System ECHS to version 5.7.1 or later immediately. This is a vendor-released patch confirmed by the vendor advisory (referenced in VulDB 361357). The upgrade resolves the missing authentication check on the /cdemos/echs/api/v2/patient-records endpoint. Until patching is feasible, implement network-level compensating controls: restrict HTTP/HTTPS access to the /cdemos/echs/api/v2/patient-records endpoint at the firewall or API gateway to only authorized internal networks and trusted healthcare provider systems; enable WAF rules to require authentication tokens in all requests to this endpoint; implement API rate limiting to slow brute-force and automated scanning attempts. Note that network restrictions introduce operational friction for legitimate API consumers and require coordination with clinical workflows. Because this is a healthcare system, document all remediation steps for compliance audits (HIPAA audit logs, incident response procedures).