Executive Summary

Title Patterson Dental Eaglesoft uses a hard-coded database password across installations
Name VU#344432 First vendor Publication 2016-03-30
Vendor VU-CERT Last vendor Modification 2016-03-30
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#344432

Patterson Dental Eaglesoft uses a hard-coded database password across installations

Original Release date: 30 Mar 2016 | Last revised: 30 Mar 2016


Patterson Dental Eaglesoft is a dental records software. Eaglesoft uses a hard-coded database password that is shared across all installations.


CWE-798: Use of Hard-coded Credentials - CVE-2016-2343

According to the researcher, Eaglesoft uses hard-coded credentials to access a database back-end. The credentials are the same across installations of Eaglesoft. Sensitive patient information is contained in Eaglesoft databases. An administrator is unable to change these credentials without breaking access to the back-end database.

The researcher has published a blog post with more information.


An attacker with knowledge of the hard-coded credentials and with network access to the database may be able to obtain sensitive patient information.


The CERT/CC is currently unaware of a full solution to this problem.

Offices deploying Eaglesoft should consider the following workarounds and mitigations:

Restrict Network Access

As a general good security practice, only allow connections from trusted hosts and networks. Restricting access would prevent an attacker from using the hard-coded credentials from a blocked network location.

Do not allow the Eaglesoft database to be accessed by unauthorized users on an insecure wireless network. If the Eaglesoft database is accessible from an insecure wireless network, a remote attacker may be able to gain access using the hard-coded credentials. Wireless access points should be configured to use WPA2 encryption and disable the WiFi Protected Setup (WPS) PIN. Encryption standards such as Wired Equivalent Privacy (WEP) can be easily cracked and should not be relied on to secure wireless networks.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Patterson DentalAffected19 Feb 201630 Mar 2016
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)



  • http://www.databreaches.net/22000-dental-patients-info-exposed-on-unsecured-eaglesoft-ftp-server/
  • http://justinshafer.blogspot.com/2016/02/moving-onto-eaglesoft-aka-patterson.html
  • http://justinshafer.blogspot.com/2016/03/eaglesoft-18-security.html


Thanks to Justin Shafer for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs:CVE-2016-2343
  • Date Public:15 Feb 2016
  • Date First Published:30 Mar 2016
  • Date Last Updated:30 Mar 2016
  • Document Revision:42


If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/344432

CPE : Common Platform Enumeration

Application 1

Alert History

If you want to see full details history, please login or register.
Date Informations
2016-04-04 21:30:32
  • Multiple Updates
2016-04-02 05:27:25
  • Multiple Updates
2016-03-30 17:22:50
  • First insertion