CVE-2025-61959: Hospital Manager Information Disclosure

CVE-2025-61959 Overview

CVE-2025-61959 is an information disclosure vulnerability in Vertikal Systems Hospital Manager Backend Services. Prior to September 19, 2025, the application returned verbose ASP.NET error pages in response to invalid WebResource.axd requests. These responses exposed framework details, ASP.NET version strings, stack traces, internal file paths, and the insecure customErrors mode="Off" configuration. Unauthenticated attackers on the network could trigger these errors to enumerate the technology stack and internal layout of the host. The weakness is tracked under [CWE-209: Generation of Error Message Containing Sensitive Information].

Critical Impact
Unauthenticated remote attackers can harvest ASP.NET framework versions, stack traces, and internal paths from a healthcare backend service, enabling targeted follow-on attacks.

Affected Products

Vertikal Systems Hospital Manager Backend Services (versions prior to the September 19, 2025 fix)
Deployments running ASP.NET with customErrors mode="Off"
Instances exposing WebResource.axd handlers to untrusted networks

Discovery Timeline

2025-10-29 - CVE-2025-61959 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61959

Vulnerability Analysis

The Hospital Manager Backend Services runs on ASP.NET and exposes the built-in WebResource.axd handler used to serve embedded resources. When a client sent a malformed or invalid request to this handler, the server responded with the default ASP.NET yellow-screen error page. The response body included the ASP.NET version, .NET Framework version, a full managed stack trace, and absolute file system paths from the deployment directory. The page also reported the presence of <customErrors mode="Off"/> in web.config, confirming that verbose diagnostics were enabled in production.

This category of flaw does not corrupt data or bypass authentication directly. Instead, it lowers the cost of reconnaissance against a healthcare application governed by CISA ICS medical advisory guidance. See the CISA ICS Medical Advisory ICSMA-25-301-01 for the coordinated disclosure record.

Root Cause

The root cause is an unsafe production configuration. ASP.NET renders detailed exception pages when customErrors is set to Off or when debug="true" is enabled in web.config. The Hospital Manager Backend Services shipped or was deployed with this diagnostic mode active, so any unhandled exception in the WebResource.axd pipeline surfaced internal implementation details to remote callers.

Attack Vector

An unauthenticated attacker sends a crafted HTTP GET request to /WebResource.axd with an invalid or missing d parameter. The handler raises an exception that the framework serializes into an HTML error page and returns with status 500. The attacker parses the response to extract the ASP.NET version, .NET runtime version, deployment path, and internal class or method names from the stack trace. This information can be used to select version-specific exploits, map internal directory structure, and identify third-party components in use.

Because no authentication or user interaction is required, the exposure is reachable by any client that can reach the web endpoint over the network. No verified proof-of-concept has been published for this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-61959

Indicators of Compromise

HTTP 500 responses from /WebResource.axd that contain the strings Server Error in, Stack Trace:, or customErrors mode="Off"
Repeated inbound requests to WebResource.axd with malformed or empty d and t query parameters
Response bodies exposing absolute paths such as c:\inetpub\wwwroot\ or ASP.NET version banners in HTTP replies

Detection Strategies

Inspect web server access logs for bursts of WebResource.axd requests from a single source followed by 500 status codes
Deploy web application firewall rules that flag outbound responses containing ASP.NET stack traces or System.Web type names
Correlate reconnaissance patterns against the Hospital Manager endpoint with subsequent authentication or exploitation attempts

Monitoring Recommendations

Enable full request and response logging on the Hospital Manager IIS host and forward logs to a centralized platform
Alert on any HTTP response from the application whose body length exceeds a baseline for error responses
Track the ratio of 5xx responses per source IP over rolling windows and threshold on anomalies

How to Mitigate CVE-2025-61959

Immediate Actions Required

Upgrade Hospital Manager Backend Services to the fixed release provided by Vertikal Systems after September 19, 2025
Set customErrors mode="RemoteOnly" or On in web.config and configure a generic defaultRedirect error page
Set <compilation debug="false"/> in web.config on all production hosts
Restrict network access to the Hospital Manager endpoint to trusted clinical network segments

Patch Information

Vertikal Systems addressed the verbose error behavior in updates released after September 19, 2025. Coordination and remediation guidance for healthcare operators is documented in the CISA ICS Medical Advisory ICSMA-25-301-01. Operators without an available patch should contact the vendor through the Vertikal Systems Product Contact Page for update packages.

Workarounds

Configure a reverse proxy or WAF to strip ASP.NET error pages and return a generic 500 response to external clients
Remove or restrict access to the WebResource.axd handler if not required by the deployment
Apply IIS request filtering rules to reject WebResource.axd requests with malformed d or t parameters

bash

# Configuration example: enforce safe error handling in web.config
# <system.web>
#   <customErrors mode="On" defaultRedirect="~/Error.aspx" />
#   <compilation debug="false" />
# </system.web>
# <system.webServer>
#   <httpErrors errorMode="Custom" existingResponse="Replace" />
# </system.webServer>