A sensitive data exposure vulnerability in Advantech Hospital Queuing Management allows unauthenticated attackers to access internal API documentation, facilitating further reconnaissance.

The software fails to enforce authentication for a specific URL endpoint, resulting in the exposure of sensitive API documentation to unauthenticated remote attackers.

While the CVSS score of 9.8 reflects the severity of exposing internal system architecture, the primary risk is reconnaissance. Access to API documentation provides attackers with a roadmap of the application's internal functions, significantly lowering the barrier for discovering and exploiting additional, more severe vulnerabilities.

Immediate Action: Update the Advantech Hospital Queuing Management software to the latest version to restrict access to sensitive documentation endpoints.

Proactive Monitoring: Monitor logs for unauthorized access attempts to administrative or documentation-related URLs.

Compensating Controls: Implement access control lists (ACLs) or authentication requirements at the network perimeter or reverse proxy level to prevent unauthenticated access to the application.

Public Exploit Available: No

Although this vulnerability does not provide direct code execution, the exposure of internal API documentation is a significant security lapse that aids attackers in planning targeted attacks. Security teams should prioritize patching to close this information disclosure vector and prevent further system mapping by unauthorized parties.