CVE-2025-67752 - Vulnerability Analysis

Overview

OpenEMR < 7.0.4 contains a man-in-the-middle vulnerability caused by disabled SSL/TLS certificate verification in HTTP client wrapper, letting attackers intercept external HTTPS communications, exploit requires network access.

Severity & Score

Impact

Attackers can intercept and manipulate sensitive healthcare data, potentially exposing protected health information.

Mitigation

Upgrade to version 7.0.4 or later.

References

• https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a
• https://github.com/openemr/openemr/security/advisories/GHSA-2g6h-725p-pqhp

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2025-67752 - High (8.1) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67752/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner