CVE-2026-14162: Advantech Hospital Queuing Management: Sensitive Data Exposure of API Documentation
Advantech Hospital Queuing Management has a sensitive data exposure flaw, classified as missing authentication for a critical function (CWE-306), that lets unauthenticated remote attackers reach API documentation through a specific URL. The CVSS 3.1 base score is 9.8 (critical), and TWCERT/CC also reports a CVSS 4.0 score of 9.3. The record lists no affected or fixed versions, so administrators should consult the referenced advisories and restrict access to documentation endpoints.
Overview
This advisory concerns a sensitive data exposure issue in the Hospital Queuing Management product from Advantech. According to the record, an unauthenticated remote attacker can access a specific URL and obtain API documentation. The weakness is mapped to CWE-306, missing authentication for a critical function.
Impact
- The exposed documentation may reveal how the application's interfaces are structured, which can help an attacker plan further activity against the system.
- The CVSS 3.1 vector indicates network reachability, low complexity, no required privileges and no user interaction, with high impact on confidentiality, integrity and availability as scored by the CNA.
- The TWCERT/CC CVSS 4.0 score of 9.3 is also reported in the record.
Affected products and versions
The record does not list any affected product versions or fixed versions. Identifying the exact vulnerable builds requires the vendor or the referenced advisories, which were not available in full within the record.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted, although this does not rule out exploitation.
Remediation and mitigation
- Review the referenced advisories from TWCERT/CC (Chinese version) and TWCERT/CC (English version) for vendor guidance.
- Contact Advantech to confirm the affected versions and the availability of a fix. The absence of a fixed version in the record does not mean no fix exists.
- Restrict network access to the application so that documentation endpoints are not reachable from untrusted networks.
- Require authentication for any API documentation or administrative paths, and remove documentation from production where it is not needed.
- Place hospital queuing systems behind network segmentation to limit exposure of clinical and patient-related data.
Detection guidance
- Review web server and application logs for unauthenticated requests to API documentation paths, especially from external addresses.
- Monitor for unusual access patterns to documentation or discovery endpoints followed by requests to other application interfaces.
- Inventory all instances of the product and verify whether their documentation endpoints respond without credentials.
Limitations of the available information
The record does not include the affected or fixed versions, the specific URL path, the vendor's own advisory text, or any exploitation telemetry beyond the EPSS value. The CVSS 4.0 score is reported by TWCERT/CC, and the record does not confirm which product builds are affected.
Frequently asked questions
Is this vulnerability being actively exploited?
The record shows it is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted, although this does not rule out exploitation.
Which versions are fixed?
The record does not list fixed versions. Check the TWCERT/CC advisories and contact Advantech to confirm the remediation status.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.