PT-2025-39873 · Medical Informatics Engineering · Enterprise Health

Fernando Martinez + 3 · Published 2025-09-29 · Updated 2026-01-02 · CVE-2025-35032

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Medical Informatics Engineering Enterprise Health versions prior to 2025-04-08

Description Authenticated users are able to upload arbitrary files. The impact of this behavior is dependent on how these files are accessed. Approximately 2000 healthcare organizations worldwide utilize this software. There are no details about real-world exploitation of this issue.

Recommendations Update to version 2025-04-08 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-35032

Affected Products

Enterprise Health

References · 7

• https://cve.org/CVERecord?id=CVE-2025-35032 · Security Note
• https://osv.dev/vulnerability/CVE-2025-35032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-35032 · Security Note
• https://twitter.com/VulmonFeeds/status/1972887360565031145 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json · Note
• https://t.me/cveNotify/147621 · Telegram Post
• https://twitter.com/CVEnew/status/1972757223169228940 · Twitter Post