This vulnerability involves the use of hard-coded cryptographic keys (CWE-321) embedded in client-side JavaScript within the e-Sushrut HMIS product by CDAC-Noida. Because the AES keys are hard-coded and accessible in the client code, an unauthenticated remote attacker can retrieve these keys without any privileges or user interaction. This compromises the confidentiality of encrypted data protected by these keys. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No vendor patch or official remediation level has been published as of the vulnerability disclosure date.

Successful exploitation allows an unauthenticated remote attacker to obtain hard-coded AES encryption keys from client-side JavaScript, leading to exposure of sensitive information and undermining cryptographic protections within the e-Sushrut HMIS. This can result in compromise of confidentiality of sensitive data managed by the system. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to client-side code where possible and avoid relying on client-side cryptographic keys for sensitive data protection. Monitor vendor communications for updates on patches or official mitigations.