This vulnerability (CVE-2026-42251) in KAMSOFT KS-SOMED arises from the use of hard-coded credentials (CWE-798) within the application modules KSPLUPDFTP.exe and ANEKSKLIENT.EXE. These credentials provide unauthorized access to the FTP server that hosts update packages. Exploitation could allow an attacker to upload malicious update files, which might then be distributed and installed on client systems as legitimate updates. The affected versions are KSPLUPDFTP.exe up to 30.00.00.056 and ANEKSKLIENT.EXE up to 29.00.02.026. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation level has been published yet.

The vulnerability enables unauthorized access to the FTP server via hard-coded credentials, potentially allowing an attacker to upload malicious update files. This could lead to the distribution of compromised updates to client machines, posing a significant risk to system integrity. However, the access granted by these credentials was limited to read-only, which may reduce the risk of direct modification but does not eliminate the threat of malicious uploads if the FTP server permits it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting FTP server access, monitoring update package integrity, and applying any vendor recommendations once available. Avoid relying on the affected versions and plan for updates once patches are provided.