A critical hard-coded credential vulnerability in the Care Everywhere Gateway allows unauthenticated remote attackers to gain full administrative control and execute arbitrary code.

The application utilizes hard-coded credentials within the bundled WildFly 8.2.0.Final management interface, which is exposed on port 20990. This flaw allows unauthenticated remote attackers to log into the console and deploy malicious web archives, resulting in full remote code execution.

Successful exploitation grants an attacker full administrative control over the underlying Windows host. Given the CVSS score of 9.8, this vulnerability poses a catastrophic risk to data confidentiality, integrity, and availability. Compromise of this gateway could serve as a pivot point for further lateral movement within the production network.

Immediate Action: Because the affected version is end-of-life, organizations must migrate to a supported version immediately or isolate the gateway from all network access until a secure replacement is deployed.

Proactive Monitoring: Audit network traffic for unauthorized connections to port 20990 and inspect the WildFly deployment directories for any suspicious or unrecognized web application files.

Compensating Controls: Implement strict firewall rules to prevent external access to the WildFly management interface on port 20990, limiting access to trusted internal management subnets only.

Public Exploit Available: Unknown.

This is a critical security finding that requires immediate remediation. Due to the end-of-life status of the affected software, patching is not a viable long-term strategy; users should prioritize migrating to a current, supported version of the platform to eliminate the exposure permanently.