Description
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Vertikal Systems | Hospital Manager Backend Services | ≤ September 19, 2025 | — |
Advisories 1
- ICSMA-25-301-01 Vertikal Systems Hospital Manager Backend Services CISA ICS & IT advisories · Oct 28, 2025