Leqing Medical Management System has two vulnerabilities affecting versions 2.4.2.8 to 2.5.1.9; update to 2.5.2.0 or later immediately.
According to the TWCERT TVN announcement, the Leqing Medical Management System has 2 vulnerabilities. The TVN ID is TVN-202608007, corresponding to CVE-2026-78685 and CVE-2026-82181, with a public disclosure date of 2026-08-25.[1]
Among them, CVE-2026-78685 is labeled Remote Code Execution, with a CVSS score of 8.8 (High); CVE-2026-82181 is classified as Sensitive Data in URL, with a CVSS score of 5.5 (Medium).[1]
The announcement states that the affected products are Leqing Medical Management System versions 2.4.2.8 through 2.5.1.9, and the remediation is to update to version 2.5.2.0 or later.[1]
The core risk of CVE-2026-78685 is that an unauthenticated remote attacker can use a specially crafted HTML page to execute arbitrary operating system commands.[1]
From the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, this vulnerability is network-reachable, low in attack complexity, requires no privileges, but does require user interaction.[1]
CVE-2026-82181 is classified as Sensitive Data in URL, and the announcement explains that an unauthenticated remote attacker can obtain sensitive information by viewing the victim's browser history or logs.[1]
Although the two vulnerabilities differ in type, both indicate high-risk characteristics of sensitive data exposure and remote exploitability.[1]
The impact scope of this issue clearly covers Leqing Medical Management System versions 2.4.2.8 through 2.5.1.9.[1]
Because the announcement does not provide more detailed attack chains, exploitation conditions, or affected module information, in practice version inventory and risk classification should be prioritized.[1]
The first priority is to immediately upgrade Leqing Medical Management System to version 2.5.2.0 or later, which is the remediation explicitly provided in the announcement.[1]
Second, any URL that may carry parameters should be reviewed to avoid sensitive data appearing in browser history or system logs.[1]
Third, if the system cannot be upgraded immediately, access controls and log monitoring should be strengthened so abnormal requests or suspicious behavior can be detected early.[1]
Fourth, host-level integrity should be checked in parallel to reduce the persistence risk after a successful Remote Code Execution attack.[1]
Fifth, awareness should be raised among users and operations staff, especially regarding links or abnormal pages from unknown HTML pages, because the announcement has already indicated that a specially crafted HTML page may be the attack trigger surface.[1]
Overall, this announcement shows that the Leqing Medical Management System has both an RCE vulnerability that can lead to arbitrary command execution and a URL exposure issue that can cause sensitive data leakage.[1]