CVE-2026-42251: Hard-coded credentials in KS-SOMED

Synopsis

Hard-coded credentials in KAMSOFT KS-SOMED (modules KSPLUPDFTP.exe up to 30.00.00.056 and ANEKSKLIENT.EXE up to 29.00.02.026) allow any unauthenticated attacker who discovers the embedded credentials to authenticate to the application's FTP update server over the network. No prior account or privilege is needed; the credentials are baked into the client binary. Successful exploitation enables the attacker to upload a malicious update package that may be distributed to and silently installed on end-user machines as a legitimate software update. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the application's FTP update server over the network; the CVSS vector specifies AV:N, meaning no physical or local access is needed.

• AuthenticationNot required

  The credentials required to log in are hard-coded in the client binary, so any attacker who extracts them faces no effective authentication barrier (PR:N).

• Victim interactionNot required

  No victim action is needed to expose the FTP server; the attacker operates entirely against the server-side endpoint without requiring a user to click or open anything (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L): exploiting the hard-coded credentials requires no race condition, special timing, or environmental prerequisite beyond network access to the FTP server.

Blast Radius

• An attacker reads any files hosted on the FTP update server, including legitimate update packages, using the exposed credentials (high confidentiality impact on the vulnerable component).
• An attacker uploads a malicious file to the FTP update server, replacing or supplementing legitimate update packages with trojanized ones.
• Client machines that pull and install the tampered update package execute attacker-controlled code under the guise of a trusted software update.
• Depending on the privileges of the update installer on client machines, the attacker gains persistent code execution across every host in the KS-SOMED deployment that applies the poisoned update.