CVE-2024-3699 is a critical severity vulnerability (CVSS 9.8) in drEryk Gabinet. The software ships a database password that is the same on every installation, which lets an attacker read the patients' database. The record does not name a fixed version.
What's affected
- drEryk Gabinet versions from 7.0.0.0 through 9.17.0.0, according to the record.
Severity in the record: Critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-259, CWE-798, use of a hard-coded password and use of hard-coded credentials.
Fixed version: The record does not name a fixed version. The references include a CERT Polska post and the vendor product page, and they are where to look for a patched release and instructions.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Inventory where drEryk Gabinet is deployed, including test and forgotten servers.
- Search your servers and container images for the product name and compare the version against the affected list above.
- If you cannot confirm the version, treat the installation as exposed until the vendor says otherwise.
What to do now
- Check the vendor or national CERT notice for a patched build and a way to change the database credentials.
- Block network access to the database port from anywhere except the application host.
- Treat the data as potentially exposed and follow your breach assessment process if the database was reachable from other systems.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3699.
Why it matters
A hard-coded password is baked into the software, so every installation shares it. Once anyone learns it, by reading the files, reverse engineering the program or seeing it published, they hold a key to every deployment. The fix is to generate a unique secret per installation or to avoid shared credentials altogether.
The data at risk is a patients' database, so the impact is not only technical. Health records carry legal duties in most countries, and a shared password means one disclosure affects every clinic running the product. Operators should ask the vendor how to set a unique credential and how to keep the database port closed to everything except the application.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Does one clinic's setup matter if the password is shared?
Yes. The password is the same across installations, so knowing it from any source works against any exposed database. Your protection is keeping the database port unreachable from outside the application host.
Is CVE-2024-3699 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
