CVE-2025-15235
📋 TL;DR
This vulnerability in QOCA aim AI Medical Cloud Platform allows authenticated attackers to modify network packet parameters, enabling unauthorized access to other users' files. It affects healthcare organizations using Quanta Computer's cloud platform. The issue stems from missing authorization checks in specific system functions.
💻 Affected Systems
- QOCA aim AI Medical Cloud Platform
📦 What is this software?
Qoca Aim by Quantatw
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive medical records, patient data, and confidential healthcare information, leading to privacy violations, regulatory penalties, and potential medical identity theft.
Likely Case
Authenticated users could access files belonging to other users within the same organization, potentially exposing sensitive but non-critical operational documents.
If Mitigated
With proper network segmentation and access controls, impact would be limited to specific user directories rather than system-wide access.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of specific packet parameters to modify.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references
Vendor Advisory: https://www.twcert.org.tw/en/cp-139-10616-cd942-2.html
Restart Required: Yes
Instructions:
1. Contact Quanta Computer for patch details 2. Apply vendor-provided security update 3. Restart affected services 4. Verify authorization controls are functioning
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to the platform to trusted IP ranges only
Enhanced Authentication
allImplement multi-factor authentication for all user accounts
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the platform from other systems
- Enable detailed audit logging for all file access attempts and regularly review logs
🔍 How to Verify
Check if Vulnerable:
Check if your organization uses QOCA aim AI Medical Cloud Platform and review access logs for unauthorized file access patternsCheck Version:
Contact Quanta Computer support for version verificationVerify Fix Applied:
Test authorization controls by attempting to access other users' files with authenticated test accounts📡 Detection & Monitoring
Log Indicators:
- Unauthorized file access attempts
- User accessing files outside their normal scope
- Multiple failed authorization checks
Network Indicators:
- Unusual packet modifications to platform endpoints
- Suspicious parameter manipulation in requests
SIEM Query:
source="qoca_platform" AND (event_type="file_access" AND user_id!=file_owner) OR (auth_failure AND resource_type="file")