CVE-2025-61959 Vertikal Systems CVE debrief

Who should care

Organizations running Vertikal Systems Hospital Manager Backend Services, especially administrators responsible for internet-facing deployments, web application owners, and defenders monitoring for ASP.NET error leakage or exposed internal paths.

Technical summary

The advisory describes a server-side error handling misconfiguration rather than code execution or data manipulation. When invalid WebResource.axd requests were received, the application returned detailed ASP.NET error pages instead of generic failures. The disclosed content included framework/version information, stack traces, internal paths, and the insecure customErrors mode="Off" setting. This is a low-complexity, network-reachable information disclosure condition with no required privileges or user interaction in the CVSS vector provided by the source.

Defensive priority

Medium. The issue is already reported as fixed by September 19, 2025, so remaining risk is primarily from unpatched or unreachable-for-update deployments and from any systems that may still be exposing verbose ASP.NET error behavior.

Recommended defensive actions

• Confirm the Hospital Manager Backend Services deployment is updated to a Vertikal Systems release that includes the September 19, 2025 fix.
• Verify ASP.NET custom error handling is not exposing detailed stack traces or internal paths to remote users.
• Test invalid WebResource.axd requests from a controlled environment to ensure only generic errors are returned.
• Review externally accessible web endpoints for other verbose error messages that could aid reconnaissance.
• Use the official Vertikal Systems support contact if assistance is needed for remediation or validation.

Evidence notes

The debrief is based on the supplied CISA CSAF advisory for CVE-2025-61959 and its listed official references. The advisory states the issue affected Hospital Manager Backend Services prior to September 19, 2025 and that Vertikal Systems fixed it by that date. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) supports a network-reachable, low-complexity confidentiality issue. No KEV listing, ransomware linkage, or exploitation details were provided in the corpus.

Official resources