CVE-2026-14161

Executive Summary

CVE-2026-14161 is a critical sensitive data exposure vulnerability in Advantech's Hospital Queuing Management (HQM) system, a web-based patient queuing and appointment management platform deployed in hospital and clinic networks. The vulnerability allows an unauthenticated remote attacker to access a specific URL that exposes the complete API documentation for the HQM application, revealing internal API endpoints, parameter schemas, authentication mechanisms, and database interaction patterns. With a CVSS score of 8.7, this vulnerability is rated High severity and provides a low-complexity attack vector requiring no user interaction or privileges, enabling attackers to map the entire API surface of the system and subsequently chain this information disclosure with other attacks to compromise the integrity and availability of hospital queuing operations.

The affected product is deployed primarily in healthcare environments across Asia-Pacific and other regions where Advantech's medical-grade computing and IoT solutions are prominent. Since there is no authentication or access control on the API documentation endpoint, any attacker with network reachability to the HQM web service can retrieve sensitive architectural details. Patch confidence is rated 2/4 (CLAIMED), meaning a single source (the CNA) has reported a patch, but it has not been independently verified. The vendor recommends upgrading to HQM ISO version 1.2.13 or replacing QueueHttp.dll with version 1.2.12.7 or later.

Technical Analysis

CVE-2026-14161 is fundamentally an information disclosure flaw rooted in insecure default configuration. The HQM application, built by Advantech's medical division, runs a web-based queuing management interface that provides real-time patient flow management, appointment scheduling, and queue display updates for hospital departments. The application's core business logic is exposed via a RESTful API served through a dynamic link library named QueueHttp.dll.

The vulnerability exists because the application exposes its API documentation endpoint without any authentication or network-level access restrictions. When an unauthenticated remote attacker sends an HTTP GET request to the specific undocumented URL path, the application responds with the full API documentation in structured form (commonly JSON or Swagger/OpenAPI format). This documentation typically contains:

1. Complete endpoint inventory — Every route the API exposes, including administrative endpoints for queue reconfiguration, patient data retrieval, display board management, and system diagnostics.
2. Parameter schemas — Field names, types, required/optional flags, and validation rules for all request and response payloads.
3. Authentication details — How the API authenticates requests (e.g., API keys, session tokens, or no authentication for certain endpoints), exact header names, and token formats.
4. Data models — The structure of patient records, queue entries, department configurations, and user accounts stored within the application's database.
5. Error handling semantics — How the API responds to invalid input, which can be used to fingerprint backend technologies and discover hidden functionality.

The vulnerability classifies as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack surface is the HQM web service, typically listening on TCP port 80 or 443, reachable over the hospital LAN or, in misconfigured deployments, through internet-facing exposure via NAT or DMZ placements.

From a code-level perspective, the issue arises because the QueueHttp.dll module registers a static route handler for the documentation path without applying middleware authentication checks. Unlike other API endpoints that may require session validation or API key verification, the documentation route is registered as an anonymous-access handler, likely for developer convenience during initial deployment. This oversight persists into production environments because the default configuration is permissive and requires manual hardening by administrators — a process that is frequently skipped in healthcare environments where uptime and usability take precedence over security configuration.

The severity is amplified by the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. The network vector and low attack complexity reflect that the vulnerability can be exploited from any network position without authentication. The high confidentiality impact comes from exposing sensitive API schemas and potentially patient data structure; the high integrity impact stems from the documentation enabling attackers to craft precise, valid API requests to modify queue data; and the low availability impact reflects the potential to disrupt queuing operations through targeted API abuse.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: The attacker begins by scanning for target deployments of the HQM system. Using Shodan or other internet-wide scanning tools, the attacker searches for devices with the HQM web interface fingerprint, commonly identified through page titles containing "Hospital Queuing Management" or "HQM". In hospital environments, the target may also be reliably discovered through the presence of queue display endpoints or legacy web application fingerprints. The attacker narrows the target list to reachable HQM instances, either publicly exposed or accessible via VPN/compromised access.

Step 2 — API Documentation Retrieval (Initial Exploitation): With a target identified, the attacker sends an HTTP GET request to the undocumented API documentation URL. Based on the vulnerability description, this is a fixed or predictable path that does not require any authentication token, session cookie, or special headers. For example, the attacker may request /api-docs, /swagger, /swagger.json, /hqm/api/docs, or /api/documentation. The server responds with a 200 OK containing the full API documentation payload. The attacker saves this response for offline analysis.

Step 3 — Payload/Execution — API Mapping and Schema Analysis: The attacker parses the retrieved API documentation to build a complete map of the HQM application's attack surface. They identify endpoints grouped by functionality:

• GET /api/queue/status — Current queue state and patient positions
• POST /api/queue/reorder — Manual queue reordering
• GET /api/patient/{id} — Patient details retrieval (PII exposure)
• POST /api/patient/register — New patient registration
• DELETE /api/queue/{id} — Queue entry removal
• GET /api/system/config — System configuration and connection strings
• POST /api/admin/user/reset — Password reset for user accounts

The attacker also extracts the exact request/response JSON schemas, noting that some endpoints may lack any authentication despite being described in the docs. They identify which endpoints require tokens and which are open, allowing them to prioritize attack paths.

Step 4 — Post-Exploitation and Chained Attacks: Using the API documentation, the attacker crafts targeted requests:

• Data exfiltration: The attacker queries patient record endpoints in a loop, extracting PII (names, ID numbers, contact details, visit history) from the HQM database, potentially violating healthcare data protection regulations (e.g., HIPAA in the US, PDPA in Singapore, GDPR in Europe).
• Queue disruption: The attacker submits well-formed POST requests to queue reordering or cancellation endpoints, causing patient confusion, missed appointments, and operational chaos in the hospital's departments. A misconfigured display board showing incorrect queue numbers can cause physical crowd management issues.
• Lateral movement: If the API documentation reveals a database connection string or administrative credential format, the attacker may attempt to reach other hospital network segments, moving from the HQM system to adjacent clinical systems.
• Ransomware precursor: The attacker may use the API documentation to identify the database type and backup mechanisms, preparing for a double-extortion ransomware campaign where data is stolen before encryption.

The attack chain requires no prior access, no authentication, and no specialized tools beyond standard HTTP clients (e.g., curl, Burp Suite, or Python scripts). The minimum viable payload is a single HTTP GET request to the documentation URL, making detection challenging for organizations without API monitoring or web application firewall rules tailored to block anonymous access to documentation paths.

Impact Assessment

The business impact of CVE-2026-14161 is severe for healthcare organizations that rely on the HQM system for daily patient flow management. The vulnerability enables complete architectural disclosure of the HQM API, which cascades into multiple downstream threats:

• Patient Privacy Violations: The API documentation reveals the structure of patient records held by the system. Attackers can query patient endpoints and extract sensitive health information, clinically identifying data, and personal details. Healthcare organizations face direct regulatory penalties (fines under HIPAA, GDPR Article 83, or national health data protection laws), legal liability, and irreversible damage to patient trust.

• Operational Disruption: HQM is mission-critical in hospitals — it manages queue numbers for outpatient clinics, emergency departments, and diagnostic procedures. An attacker who maps the queue management API can arbitrarily reorder, cancel, or duplicate queue entries. The resulting chaos in overwhelmed healthcare facilities can delay critical patient care, potentially leading to adverse patient outcomes and liability for the hospital.

• Wide Blast Radius in Healthcare Networks: HQM typically operates within a hospital LAN with network access to patient administrative systems, laboratory information systems, or hospital information systems (HIS). The API documentation exposes database interaction patterns and connection details, which can be leveraged for lateral movement. A single exposed HQM instance can become the entry point for a full hospital network compromise.

• CVSS Scoring Rationale: The 8.7 High score reflects the network-exploitable, low-complexity nature of the flaw. The confidentiality and integrity subscores of H and H, respectively, emphasize that both data disclosure and data manipulation are achievable. The availability subscore of L indicates lower direct impact on uptime, but availability is still affected through the queue manipulation pathways.

• Attack Chain Enablement: This CVE is rarely the final payload in an attack — it is an enabler. It reduces the barrier for subsequent exploitation of additional HQM flaws or misconfigurations. Attackers can chain this information disclosure with default credential testing, database direct access, or other known Advantech product vulnerabilities to achieve full system takeover.

• CISA KEV Status: This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and there is no public evidence of exploitation in the wild. However, the EPSS percentile of 36.0% indicates that the vulnerability is considered reasonably likely to be exploited in the near future, especially given the gravity of healthcare targeting by cybercriminals.

Detection Guidance

Sigma Rule

title: CVE-2026-14161 - Advantech HQM API Documentation Access
id: 7f4c2a91-8b6e-4d22-9c3f-1a5f6c2e7d44
status: experimental
description: Detects unauthenticated access to Advantech Hospital Queuing Management API documentation endpoint
author: Valters IT Security Team
date: 2026/02/15
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: Web server access logs for the HQM host'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/api-docs'
            - '/swagger'
            - '/swagger.json'
            - '/openapi.json'
            - '/hqm/docs'
            - '/api/documentation'
        sc-status: 200
    filter_known_good:
        c-ip|startswith:
            - '10.'      # Internal IPs - adjust to organizational ranges
            - '192.168.'
            - '172.16.'
    condition: selection and not filter_known_good
falsepositives:
    - Legitimate developers or admins accessing documentation from internal IPs
    - Penetration testing authorized by the organization
level: high
tags:
    - attack.t1190
    - attack.t1595
    - cve.2026-14161

YARA Rule

rule CVE_2026_14161_Advantech_HQM_API_Docs
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects API documentation payloads associated with CVE-2026-14161 - Advantech HQM sensitive data exposure"
        date = "2026-02-15"
        cve = "CVE-2026-14161"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14161"
    strings:
        // Hospital Queuing Management module references
        $hqm_module = "QueueHttp" ascii nocase
        $hqm_path = "Queue" ascii nocase
        // API documentation content markers
        $doc_swagger = "swagger" ascii nocase
        $doc_openapi = "openapi" ascii nocase
        $doc_api = "\"paths\"" ascii
        $doc_items = "\"definitions\"" ascii
        $doc_parameters = "\"parameters\"" ascii
        $doc_responses = "\"responses\"" ascii
        // Advantech signature
        $vendor_adv = "advantech" ascii nocase
        $vendor_advu = "Advantech" ascii
        // Queue/patient schema markers
        $que_schema = "\"patientId\"" ascii
        $que_schema2 = "\"queueNumber\"" ascii
        $que_schema3 = "\"departmentName\"" ascii
        $que_schema4 = "\"appointmentId\"" ascii
    condition:
        // Look for API documentation content in web server response bodies
        uint16(0) == 0x5B7B or uint16(0) == 0x7B0D or uint16(0) == 0x7B0A or
        filesize < 2MB and
        (2 of ($doc_*) or 2 of ($que_schema*)) and
        (1 of ($hqm_*) or 1 of ($vendor_*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT CVE-2026-14161 Advantech HQM API Documentation Disclosure"; flow:established,to_server; content:"GET"; http_method; content:"/api-docs"; http_uri; nocase; content:"/swagger"; http_uri; nocase; content:"/openapi.json"; http_uri; nocase; content:"/hqm/docs"; http_uri; nocase; content:"/api/documentation"; http_uri; nocase; classtype:attempted-recon; sid:20261416; rev:1; reference:cve,2026-14161; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE_2026_14161;)

Note: The single-rule format above can be split. For production, write four separate rules — one for each URL pattern — to reduce false positives and improve rule granularity.

Elastic Detection

// Elastic EQL query for ECS-compatible web access logs
sequence by source.ip
  [ network where network.protocol == "http" and http.request.method == "GET" 
    and (
      url.path like "*api-docs*" or 
      url.path like "*swagger*" or
      url.path like "*openapi.json*" or
      url.path like "*hqm/docs*" or
      url.path like "*api/documentation*"
    )
  ]
  [ process where event.action == "http_response" and http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET"
| search uri_path IN ("/api-docs", "/swagger", "/swagger.json", "/openapi.json", "/hqm/docs", "/api/documentation")
| eval is_known_good_ip = if((clientip LIKE "10.%" OR clientip LIKE "192.168.%" OR clientip LIKE "172.16.%" OR clientip LIKE "172.17.%" OR clientip LIKE "172.18.%" OR clientip LIKE "172.19.%" OR clientip LIKE "172.2%.%" OR clientip LIKE "172.3%.%"), "yes", "no")
| where is_known_good_ip == "no"
| table _time, clientip, uri_path, status, bytes, useragent, host
| top 20 clientip by uri_path

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="261298" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(api-docs|swagger|swagger\.json|openapi\.json|hqm/docs|api/documentation)</field>
    <field name="method">GET</field>
    <match>status.*200</match>
    <description>CVE-2026-14161: Unauthenticated access to Advantech HQM API documentation endpoint</description>
    <mitre>
      <id>T1190</id>
      <id>T1595</id>
    </mitre>
    <group>cve-2026-14161,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (Before Patching):

• Network Segmentation: Restrict access to the HQM web service to authorized administration subnets only. Apply firewall access control lists (ACLs) on the HQM host and at the network perimeter to ensure the application is not reachable from the internet or untrusted network segments. Verify that no firewall rules expose the HQM web port (80/443) to the public internet.
• Web Application Firewall (WAF) Rule: Deploy a virtual patching rule on any existing WAF or reverse proxy in front of the HQM service. Block HTTP GET requests to the documented URL patterns (/api-docs, /swagger, /swagger.json, /openapi.json, /hqm/docs, /api/documentation) from unauthenticated sources. This can serve as a temporary compensating control.
• Monitor Logs: Increase logging verbosity on the HQM web server and review access logs for unexpected GET requests to documentation URLs. Correlate with firewall and IDS logs to identify potential scanning or exploitation activity.
• Restrict Administrative Interface: If the HQM admin console is available, verify that all default accounts have been disabled or password-changed, and review user roles to ensure minimal privilege assignment.

2. Patch/Upgrade Steps (Primary Fix):

• Recommended Upgrade Path: Update the HQM ISO to version 1.2.13 or later. This is the vendor-recommended fix and should provide the complete remediation for the vulnerability. Obtain the updated ISO from Advantech's official support portal or your authorized reseller.
• Alternative Minimal Deployment: If a full ISO upgrade is not feasible in the immediate term, update the QueueHttp.dll component to version 1.2.12.7 or later. This filesystem-level patch addresses the vulnerable handler directly and can be deployed as a targeted hotfix. Always take a hash of the current DLL before replacement for rollback capability.
• Validation: After applying either patch, verify the new version is active by accessing the application's admin status page or version endpoint. Test that the API documentation URL no longer returns content for unauthenticated requests. Re-run the detection queries and confirm no detection findings remain.
• Verification Caveat: Since patch confidence is 2/4 (single source claim), independently confirm the patch resolves the issue by testing the exact documented endpoint before and after upgrade. If the vendor fails to respond or the patch is unavailable, escalate to full manual hardening per item 3.

3. Long-Term Hardening:

• Configuration Review: After patching, review the HQM web server configuration to ensure no other sensitive endpoints remain unauthenticated. Enumerate all listening ports and verify each service has appropriate access controls.
• Change Default Credentials: Force password rotation for all HQM administrative accounts and enforce strong password policies. If the API documentation reveals any hardcoded credentials or default tokens, check whether they are still active and rotate immediately.
• Proxy and TLS Termination: Place the HQM service behind a reverse proxy (Nginx, Apache, or a cloud load balancer) that enforces mutual TLS or at least client certificate authentication for administrative endpoints. This adds a second layer of defense-in-depth.
• Network-Level Intelligence: Integrate the HQM web server logs into your SIEM platform. Create alerting rules for any request to API documentation endpoints, repeated failed authentication attempts to the API, or unusual API query patterns that may indicate post-exploitation data harvesting.
• Vendor Relationship: Subscribe to Advantech's security advisory distribution list to receive timely notifications of future vulnerabilities in the HQM product line and other Advantech software in your environment.
• Incident Preparedness: Add CVE-2026-14161 to your organization's threat model and update the Blue Team playbook with a specific incident response runbook, including indicators of attempted API documentation harvesting, patient data exfiltration signatures, and queue manipulation patterns.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14161 — Official NIST National Vulnerability Database entry, providing the CVE description, CVSS score (8.7), and metadata.

2. Advantech Security Advisory (CNA): https://www.advantech.com/security — Advantech's official security advisory page where the vendor disclosure and patch guidance for HQM version 1.2.13 / QueueHttp.dll 1.2.12.7 are published. As the CNA, Advantech is the authoritative source for the patch.

3. TWCERT Advisory (Co-CNA/Taiwan CERT): https://www.twcert.org.tw/en/lp-137-1.html — Taiwan Computer Emergency Response Team advisory for vulnerabilities in Taiwanese-origin industrial and medical products, including coordination details for this disclosure.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Referenced to confirm CVE-2026-14161 is NOT currently listed, meaning there is no confirmed exploitation in the wild as of the report date. Treat as a monitoring resource; CISA may add this CVE to the catalog if exploitation evidence emerges.

5. EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ — FIRST.org's EPSS score of 0.00437 (36.0% percentile) which substantiates the threat assessment presented in this report and informs prioritization for remediation.

Threat Actor Campaigns & Exploit-in-the-Wild Evidence:

As of the writing of this report (February 2026), there is no known exploitation of CVE-2026-14161 in the wild, no public exploit code, and no confirmed threat actor campaigns targeting this vulnerability. The CISA KEV catalog does not list this CVE. However, the healthcare sector remains the most targeted critical infrastructure vertical for ransomware and extortion attacks, and the combination of low exploitation complexity and high information value makes this an attractive target for initial access brokers and financially motivated groups. Enterprise security teams should treat this as a "patch now" priority given the sector context, even without observed exploitation evidence.