CVE-2017-11743

MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of the hard-coded credential and the ability to communicate directly with the Mirth Connect management console may be able to intercept sensitive patient information. The admin account password is hard-coded as $K8t1ng throughout the application, and is the same across all installations. Customers do not have the option to change the Mirth Connect admin account password. The Mirth Connect admin account is created during the Connex install. The plaintext account password is hard-coded multiple times in the Connex install and update scripts.

• CWE-798

• http://seclists.org/fulldisclosure/2017/Jul/75Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/100086Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Jul/75Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/100086Third Party Advisory, VDB Entry

Published

Jul 31, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11738In Zoho ManageEngine Application Manager prior to 14.6 Build…
• CVE-2017-11739In Zoho ManageEngine Application Manager 13.1 Build 13100, a…
• CVE-2017-1174IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerab…
• CVE-2017-11740In Zoho ManageEngine Application Manager 13.1 Build 13100, t…
• CVE-2017-11741HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-f…
• CVE-2017-11742The writeRandomBytes_RtlGenRandom function in xmlparse.c in …
• CVE-2017-11744In MODX Revolution 2.5.7, the "key" and "name" parameters in…
• CVE-2017-11746Tenshi 0.15 creates a tenshi.pid file after dropping privile…
• CVE-2017-11747main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinypro…
• CVE-2017-11748VIT Spider Player 2.5.3 has an untrusted search path, allowi…
• CVE-2017-11749InternetSoft FTP Commander 8.02 and prior has an untrusted s…7.8
• CVE-2017-1175IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable …