CVE-2026-113618
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
56/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application. The issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| KAMSOFT | ZSIRep Client Library | 0.0 < 2.12.3.1 |
| KAMSOFT | ZSIRep Client Library | 0.0 < 2.12.3.1 |
References & Advisories (2)
third-party-advisory
product