zum Inhalt springen

Leaked ftp server credentials of a Swiss software development company in the Swiss health sector allowed an attacker to upload malware to the software distribution server

Swiss Health Sector

NTCF:
NTCF-2023-39982

Product:
Classified

Vendor:
Classified

Criticality:
high

Status:
fixed

Discovered:
2023-09-28

Detail:
Classified

Description

In accordance with the NTC Vulnerability Disclosure Policy, the details of this vulnerability will not be publicly disclosed.

Neither the product and vendor name nor a detailed description of the vulnerability will be publicly released if all of the following conditions are met:

  • the vendor fixes the vulnerability without requiring any action by the affected parties (e.g. a cloud service where the user is not required to install patches)
  • there is no indication that the vulnerability has been exploited (e.g. in the log files)

Further details may be provided on request. Please use the contact form.

Timeline

2023-09-28: initial discovery

2023-10-02: first contact to vendor

2023-10-03: private disclosure to vendor

2023-10-06: fix by vendor

2024-06-20: public disclosure