Iris For Health
Monthly
InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so traffic between clients and the superserver can traverse the network in cleartext and be read by anyone positioned on that path. Unauthenticated remote attackers who can observe or intercept the traffic (an on-path requirement reflected by AT:P in the CVSS 4.0 vector) may capture transmitted data, including credentials that can subsequently be reused to log into the device. No public exploit code has been identified at time of analysis, but exploitation is constrained by the interception prerequisite and is neutralized where operators have enabled TLS per the InterSystems securing checklist; the flaw was reported by ICS-CERT in advisory ICSMA-26-295-01 and carries an act_now priority label.
InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so traffic between clients and the superserver can traverse the network in cleartext and be read by anyone positioned on that path. Unauthenticated remote attackers who can observe or intercept the traffic (an on-path requirement reflected by AT:P in the CVSS 4.0 vector) may capture transmitted data, including credentials that can subsequently be reused to log into the device. No public exploit code has been identified at time of analysis, but exploitation is constrained by the interception prerequisite and is neutralized where operators have enabled TLS per the InterSystems securing checklist; the flaw was reported by ICS-CERT in advisory ICSMA-26-295-01 and carries an act_now priority label.