The vulnerability in Care Everywhere Gateway 14.3.10 arises from hard-coded default credentials in the WildFly 8.2.0.Final management interface bundled with the product. These default credentials are the same across all installations, allowing unauthenticated remote attackers to access the WildFly management console on port 20990. Once authenticated, attackers can deploy malicious Web Application Archive (WAR) files via the Deployments interface, achieving remote code execution as the Windows machine account. The affected version 14.x.x is end-of-life since 2017, and newer versions have fixed this issue.

Successful exploitation leads to unauthenticated remote administrative access to the WildFly management console, enabling deployment of malicious applications and remote code execution with Windows machine account privileges. This can result in full compromise of the affected system. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No known exploits in the wild have been reported.

No official patch or remediation level is provided for this vulnerability. Since version 14.x.x is end-of-life as of 2017, upgrading to a supported version of Care Everywhere Gateway that addresses this vulnerability is strongly recommended. In the absence of an official fix, disabling or restricting access to the WildFly management interface on port 20990 and changing default credentials (if possible) may reduce risk. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.