Bp Premier
Monthly
Authentication bypass and SYSTEM-level command execution in Best Practice Software Bp Premier before 1.14.1.1128 stem from a hardcoded, installation-wide Microsoft SQL Server sysadmin password, allowing unauthenticated remote attackers with TCP access to the database to bypass application authentication and execute operating system commands as SYSTEM under the documented default SQL service configuration. The credential is shared across all installations and cannot be changed without breaking the application, so no in-product hardening is possible pending the vendor patch. No public exploit code or CISA KEV entry was identified at time of analysis, but the main constraint is database reachability: deployments exposing SQL Server port 1433 or attackers already on the clinic LAN can exploit it.
Authentication bypass and SYSTEM-level command execution in Best Practice Software Bp Premier before 1.14.1.1128 stem from a hardcoded, installation-wide Microsoft SQL Server sysadmin password, allowing unauthenticated remote attackers with TCP access to the database to bypass application authentication and execute operating system commands as SYSTEM under the documented default SQL service configuration. The credential is shared across all installations and cannot be changed without breaking the application, so no in-product hardening is possible pending the vendor patch. No public exploit code or CISA KEV entry was identified at time of analysis, but the main constraint is database reachability: deployments exposing SQL Server port 1433 or attackers already on the clinic LAN can exploit it.