CVE-2026-14162: Advantech｜Hospital Quering Management - Missing Authentication

Synopsis

Missing authentication in Advantech Hospital Queuing Management exposes a specific URL that returns full API documentation without any credentials. The vulnerability is reachable over the network by any unauthenticated attacker, requiring no user interaction or special privileges. Successful exploitation gives an attacker read access to sensitive data, the ability to tamper with data, and can disrupt service availability. A patched-image rebuild at version 1.2.13 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's HTTP endpoint over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerable URL is accessible to any unauthenticated caller.

• Victim interactionNot required

  The attacker makes a direct request to the target URL; no end-user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or environmental prerequisites apply.

Blast Radius

• Reads full API documentation, exposing endpoint structures, parameter names, and any embedded credentials or tokens referenced in that documentation.
• Leverages disclosed API details to read sensitive patient or operational records stored by the application.
• Uses discovered API endpoints to modify persisted data such as queue entries, patient assignments, or configuration records.
• Sends crafted requests to disrupt or crash the queuing service, preventing hospital staff from managing patient flow.