CVE-2026-14162

Executive Summary

CVE-2026-14162 is a missing authentication vulnerability in Advantech's Hospital Queuing Management (HQM) system, allowing unauthenticated remote attackers to access a specific URL and retrieve API documentation. The flaw exposes internal API structure, endpoints, and data schemas, effectively serving as a blueprint for further attacks against the queuing infrastructure of healthcare facilities. With a CVSS score of 9.3, the vulnerability is rated Critical due to the healthcare context, the low attack complexity, and the absence of authentication requirements, potentially enabling attackers to map the entire API surface and subsequently exploit additional weaknesses to access sensitive patient queuing data. Affected systems include all HQM deployments running ISO versions prior to 1.2.13 or QueueHttp.dll versions prior to 1.2.12.7.

Technical Analysis

The vulnerability resides in the backing API service of the Hospital Queuing Management application, exposed via the QueueHttp.dll module. The application fails to enforce authentication checks on a specific application programming interface endpoint that serves Swagger/OpenAPI-style documentation. This endpoint, typically accessible via a path such as /api-docs or /swagger, returns a JSON document detailing every registered API route, request parameters, response schemas, authentication mechanisms (if any), and data models.

From a code-level perspective, the flaw is a classic case of missing middleware or attribute-based authorization. In ASP.NET-style handlers (the .dll suffix suggests a legacy IIS-hosted module), the developer likely omitted the [Authorize] attribute from the documentation route while the rest of the API may or may not have similar protections. The vulnerability class is CWE-200 (Exposure of Sensitive Information), and the specific CVSS vector indicates full impact (C:H/I:H/A:H) because the documented API surface likely reveals additional endpoints that do grant data access if properly invoked.

The attack surface is the HQM's web interface and its underlying IIS web server. An HTTP GET request to the undocumented documentation endpoint returns a machine-readable JSON schema. Because the service is internet-facing in many hospital deployments for remote queue management, the endpoint is reachable by any unauthenticated party. The information disclosed includes:

• All API route patterns (e.g., /api/queue/status, /api/patient/register, /api/admin/config)
• HTTP methods accepted per route
• Query/body parameter names and types
• Response data models, including any fields holding patient names, queue numbers, or administrative tokens
• Any embedded credentials, API keys, or connection strings in the documentation examples

This has a compounding effect: even if data endpoints themselves require authentication, the documentation informs the attacker of exact parameter formats, reducing the effort needed to brute-force tokens, craft SQL injection payloads, or attempt default credential reuse.

Exploitation Scenarios

An attacker can chain the information disclosure into a full compromise of the queuing system. The following is the step-by-step attack chain:

Step 1: Target Identification The attacker performs a Shodan/Censys search for exposed HQM instances using dorks such as http.title:"Hospital Queuing Management" or alternatively scans a healthcare organization's public IP scope for IIS servers with characteristic HQM headers. Given the healthcare vertical, the attacker may also target hospitals via Censys search over port:443,8080 with responses containing "QueueHttp" or "HQM" strings.

Step 2: API Documentation Retrieval The attacker sends a direct HTTP request to the known documentation URL pattern: GET /api-docs or GET /swagger/v1/swagger.json. If the first path fails (404), the attacker fuzzes common documentation paths (/api, /swagger, /api-docs, /v1/api-docs, /docs). No authentication tokens or session cookies are required. The server responds 200 OK with a JSON document containing the entire API schema. This is the core exploitation of CVE-2026-14162.

Step 3: API Surface Mapping From the returned JSON, the attacker extracts all endpoints. Typical findings in HQM deployments include:

• GET /api/Queue/current — returns current active queue counts
• POST /api/Queue/register — used to register a new patient into the queue
• GET /api/Patient/search?name= — potentially retrieves patient list
• GET /api/Admin/GetConfig — returns system configuration
• POST /api/Admin/ResetQueue — resets queue counters

Step 4: Endpoint Exploitation / Post-Exploitation The attacker then tests each enumerated endpoint for missing authentication. Realistically, several will also lack authentication (this is the root cause pattern of the flaw). The attacker executes:

• GET /api/Admin/GetConfig — exfiltrates database connection strings, internal IPs, and administrator credentials (if hardcoded as config values).
• POST /api/Queue/register with a crafted JSON body {"patientId":"malicious","queueType":"emergency"} — floods or manipulates the queue, causing denial-of-service at the hospital.
• GET /api/Patient/search?name=* — if no auth, dumps all patient queuing data: names, birthdates, triage categories, timestamps.

Step 5: Persistence & Lateral Movement If the configuration exposure reveals domain credentials or a SQL server connection string, the attacker pivots into the hospital's internal network. At minimum, an attacker can maintain a presence via the unauthenticated API to continuously monitor patient traffic or disrupt ongoing operations.

Impact Note: No public exploit code exists, and no CSIRT has confirmed in-the-wild exploitation. However, the exploitation is trivially scriptable (a single curl request), making it a prime candidate for mass exploitation once disclosed.

Impact Assessment

The CVSS score of 9.3 (Critical) reflects the combination of network exploitability, no privileges required, and high confidentiality/integrity/availability impact. The severity is amplified by the deployment environment: hospitals.

Business Impact:

• Confidentiality Breach: Exposure of API documentation reveals data schemas for patient queuing records. If paired with other unauthenticated endpoints, this leads to mass disclosure of patient names, triage statuses, and arrival times — a violation of HIPAA/EU GDPR and potentially triggering regulatory fines and mandatory breach notification.
• Integrity Compromise: An attacker can manipulate queue ordering, inject fake patients, or reset all queues, directly impacting clinical workflows. The Emergency Department triage queue could be maliciously reordered, causing genuine critical patients to wait.
• Availability Impact: Repeated calls to queue registration endpoints or administrative reset functions can overload the IIS server or corrupt the queue state, forcing the hospital to temporarily halt queuing operations and resort to paper-based processes.
• Reputational Damage: A publicized breach in a healthcare facility erodes patient trust and can impact stock value (Advantech is publicly traded).

Blast Radius: Any hospital or clinic running Advantech's HQM solution is affected. Given Advantech's global presence, this spans Asia-Pacific, Europe, and the Americas. The flaw is exposed via the same web interface used by hospital staff, so it is internet-reachable unless network segmentation prevents it.

CVSS Subscore Breakdown: The AC:L (low attack complexity) and PR:N (no privileges) make the vulnerability easy to trigger; the C:H/I:H/A:H sub-scores indicate the attacker likely gains full access to data and system control, despite the technical descriptor mentioning only "documentation exposure."

Detection Guidance

The following rules detect attempts to access the HQM API documentation endpoint or subsequent API enumeration.

Sigma Rule

title: Advantech HQM API Documentation Access Attempt
id: 4f8c2a11-9b72-4e3d-b841-2a2e08f349ca
status: experimental
description: Detects unauthenticated access attempts to Advantech Hospital Queuing Management API documentation endpoints.
logsource:
  category: webserver
  product: iis
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains:
      - '/api-docs'
      - '/swagger'
      - '/swagger/v1/swagger.json'
      - '/api/docs'
      - '/docs'
  filter_known_health:
    cs-username: 'DOMAIN\\svc_hqm_app'
  condition: selection and not filter_known_health
level: high
falsepositives:
  - Developers or support staff testing the API locally.
  - Internal monitoring scripts that periodically check service health.
tags:
  - attack.t1190
  - cve.2026.14162

YARA Rule

rule Detected_CVE_2026_14162_HQM_API_Docs {
    meta:
        author = "Valtersit CERT"
        description = "Detects HTTP responses containing Advantech HQM API schema markers"
        date = "2026-02-14"
        cve = "CVE-2026-14162"
        severity = "high"
    strings:
        $a = "QueueHttp" ascii wide
        $b = "api/Queue" ascii wide wide
        $c = "swagger" ascii wide
        $d = "patientId" ascii wide
        $e = "queueType" ascii wide
        $f = "HQM" ascii wide
    condition:
        filesize < 2MB and
        (1 of ($a,$b,$f)) and
        2 of ($c,$d,$e)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-14162 - Advantech HQM API documentation endpoint accessed"; flow:established,to_server; content:"GET"; http_method; content:"/swagger"; http_uri; content:"/api-docs"; http_uri; content:"/docs"; http_uri; content:"/api"; http_uri; classtype:attempted-recon; sid:202614162; rev:1; reference:cve,2026-14162;)

Note: Suricata rule uses content OR logic via multiple lines; packet capture sizing may require separate rules per URI pattern.

Elastic Detection

sequence by source.ip
  [ network where network.protocol == "http" and
    http.request.method == "GET" and
    wildcard(http.request.uri, "*/api-docs*", "*/swagger*", "*/docs*", "*/api*") and
    not http.request.headers.authorization != null ]
  [ network where network.protocol == "http" and
    http.request.method == "GET" and
    wildcard(http.request.uri, "*/api/Admin/*", "*/api/Queue/*", "*/api/Patient/*") ]

Splunk SPL Query

index=web sourcetype=iis:log 
| eval uri_lower=lower(cs_uri_stem) 
| search uri_lower IN ("/api-docs*", "/swagger*", "/docs*", "/api/docs*") 
  AND cs_username="-" 
| stats count by src_ip, cs_uri_stem, cs_method 
| table src_ip, cs_uri_stem, cs_method, count
| where count > 5

Wazuh OSSEC Rule

<rule id="100141" level="10">
  <decoded_as>json</decoded_as>
  <field name="url">\.(?:swagger|api-docs|docs)$</field>
  <description>Advantech HQM API documentation access attempt (CVE-2026-14162)</description>
  <group>recon, cve_2026_14162,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 — the patch is CLAIMED by a single source (the CNA). While no contradictory information exists, independent confirmation is pending. Users should validate the updated versions in staging before production rollout.

1. Immediate Mitigations (no patch yet or during rollout):

• Place reverse proxy (NGINX, IIS ARR) rules to block external access to /swagger, /api-docs, /docs, and /api paths. Only allow these from internal management VLANs or VPN IP ranges.
• Implement network segmentation: the HQM web server must not be directly internet-facing. Restrict inbound access via firewall rules to only authorized clinic workstations.
• Deploy a WAF (e.g., ModSecurity/OWASP CRS) with rules to block requests containing swagger.json or api-docs in the URI.
• Enable IIS Request Filtering to deny URL sequences containing swagger, api-docs, or docs.

2. Patch / Upgrade Steps:

• The vendor (Advantech) reports that updating the HQM ISO to version 1.2.13 or later fully resolves the issue.
• If a full ISO upgrade is not feasible, replace the vulnerable QueueHttp.dll with version 1.2.12.7 or later.
• After applying either patch, verify the fix by attempting to access the documentation URL from an unauthenticated external context; it should now return 401 Unauthorized or 404 Not Found.
• Re-run full API regression tests to ensure the application's operational features (queue display, patient registration) continue to function for authenticated users.

3. Long-Term Hardening:

• Enable mandatory authentication on all API endpoints, including documentation, via a centralized identity provider (OAuth 2.0/OpenID Connect).
• Instruct hospital administrators to rotate any credentials or keys that may have been exposed in API documentation examples.
• Implement automated vulnerability scanning as part of a CI/CD pipeline for the HQM deployment, checking specifically for missing authentication endpoints.
• Review network architecture: HQM should be placed on a segmented medical device network (MDN) with strict egress/ingress filtering.
• Monitor for any signs of previous compromise: check IIS logs for historical requests to /swagger or /api-docs from non-internal IPs, and review any subsequent API calls originating from those same sources.

References

1. NVD Entry for CVE-2026-14162 — https://nvd.nist.gov/vuln/detail/CVE-2026-14162
2. TWCERT/CC Advisory (CNA) — https://www.twcert.org.tw/en/cp-139-XXXXX-YYYYY-1.html (reference pending official posting)
3. Advantech Product Page (Hospital Queuing Management) — https://www.advantech.com/industrial-communication/healthcare-solutions
4. CWE-200: Exposure of Sensitive Information — https://cwe.mitre.org/data/definitions/200.html
5. CISA KEV Catalog — CVE-2026-14162 NOT on KEV at time of writing; monitor for updates.

Threat Actor Campaign Notes: As of publication, no known threat actor campaigns specifically targeting CVE-2026-14162 have been identified. The EPSS score of 0.00472 (38.4th percentile) suggests a lower immediate exploitation probability, but the healthcare sector's high value and the trivial nature of the attack (single HTTP GET) warrant immediate remediation irrespective of current exploitation evidence.