CVE-2026-42251: KS-SOMED Auth Bypass Vulnerability

CVE-2026-42251 Overview

CVE-2026-42251 is a hard-coded credentials vulnerability [CWE-798] in Kamsoft's KS-SOMED medical software. The flaw exposed authentication credentials for the File Transfer Protocol (FTP) server hosting the application's update packages. An unauthenticated network attacker could extract the embedded credentials from the affected modules and use them to access the update distribution server. With write access at the time of disclosure, an attacker could upload a malicious update file that client machines may have installed as a legitimate update. The issue affects the KSPLUPDFTP.exe module up to version 30.00.00.056 and ANEKSKLIENT.EXE up to version 29.00.02.026.

Critical Impact

Attackers could weaponize the hard-coded FTP credentials to push trojanized updates to KS-SOMED client installations, enabling supply chain compromise across healthcare deployments.

Affected Products

• KS-SOMED KSPLUPDFTP.exe up to version 30.00.00.056
• KS-SOMED ANEKSKLIENT.EXE up to version 29.00.02.026
• Kamsoft KS-SOMED healthcare application suite

Discovery Timeline

• 2026-06-01 - CVE-2026-42251 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42251

Vulnerability Analysis

KS-SOMED is a medical software suite distributed by Kamsoft. Two of its modules, KSPLUPDFTP.exe and ANEKSKLIENT.EXE, embedded static FTP credentials in their compiled binaries. These credentials authenticated the client to the FTP server that hosted update packages for the application. Because the credentials were identical across every installation, any party with access to a binary copy could recover them through static analysis or runtime inspection.

The consequences extend beyond information disclosure. Until the vendor restricted the affected account to read-only access, the exposed credentials granted upload privileges to the update repository. An attacker with upload privileges could place a malicious package on the FTP server, where the KS-SOMED update client would later retrieve and execute it on customer endpoints. This pattern represents a supply chain compromise vector against healthcare environments.

Root Cause

The root cause is the storage of authentication secrets inside the application binaries [CWE-798]. Hard-coded credentials cannot be rotated without redistributing the application and cannot be protected from any user who possesses the executable file. Combined with the absence of cryptographic signing checks on the update artifacts, the design allowed any holder of valid credentials to influence what client machines installed.

Attack Vector

An attacker recovers the FTP username and password by reverse engineering or running the affected modules against a network proxy. The attacker then authenticates to the Kamsoft update FTP server across the network without user interaction. Before vendor remediation, the attacker could write a crafted update package to the server path consumed by KS-SOMED clients. Endpoints running the vulnerable update component would then pull and apply the rogue package during their normal update cycle.

For technical specifics, see the CERT Poland CVE-2026-1958 Analysis and the Kamsoft Security Resource.

Detection Methods for CVE-2026-42251

Indicators of Compromise

• Outbound FTP sessions from KS-SOMED hosts to Kamsoft update infrastructure at unexpected times or to unexpected destinations.
• Update packages on client endpoints with file hashes that do not match Kamsoft's published values.
• Unexpected child processes spawned by KSPLUPDFTP.exe after an update cycle.
• Modifications to KS-SOMED installation directories outside of scheduled update windows.

Detection Strategies

• Inventory all systems running KS-SOMED and verify the versions of KSPLUPDFTP.exe and ANEKSKLIENT.EXE against the fixed releases.
• Hunt for historical FTP traffic from KS-SOMED hosts and compare destination addresses, transferred filenames, and credentials against expected baselines.
• Validate the integrity of installed update packages by comparing on-disk hashes against vendor-supplied checksums.

Monitoring Recommendations

• Alert on any FTP authentication attempt originating from endpoints that should be using the patched HTTPS-based update channel.
• Monitor KSPLUPDFTP.exe for anomalous network destinations, file writes outside the update directory, and execution of newly downloaded binaries.
• Forward endpoint process and network telemetry to a centralized log platform to support retrospective threat hunting.

How to Mitigate CVE-2026-42251

Immediate Actions Required

• Upgrade KSPLUPDFTP.exe to a release later than 30.00.00.056 and ANEKSKLIENT.EXE to a release later than 29.00.02.026.
• Confirm with Kamsoft that the previously exposed FTP account has been deactivated or rotated, not merely demoted to read-only.
• Review logs for the period prior to vendor remediation to identify any anomalous update activity on KS-SOMED endpoints.
• Restrict outbound FTP traffic from KS-SOMED hosts to only the destinations and protocols required by the patched client.

Patch Information

Kamsoft removed the hard-coded credentials from the affected modules and modified the update process. The vendor also limited the access granted by the previously exposed credentials to read-only, removing the upload vector. Refer to the Kamsoft Security Resource for current fixed versions and to the CERT Poland advisory for coordinated disclosure details.

Workarounds

• Block network access from KS-SOMED endpoints to the legacy update FTP server until patched binaries are deployed.
• Stage updates from an internal trusted repository and verify package integrity manually before allowing client installation.
• Apply application allowlisting to prevent KSPLUPDFTP.exe from executing unsigned or unverified child binaries.

# Configuration example: restrict outbound FTP from KS-SOMED hosts at the host firewall
netsh advfirewall firewall add rule name="Block KS-SOMED FTP" ^
  dir=out action=block program="C:\Program Files\KS-SOMED\KSPLUPDFTP.exe" ^
  protocol=TCP remoteport=21