Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.

1. 2021-12-21 Published
2. 2024-12-23 Added to CISA KEV
3. 2025-01-11 CISA SSVC: exploitation active
4. 2025-01-13 CISA patch deadline

Added

22 mo ago (2024-12-23)

Patch by

2025-01-13 (21 mo ago)

Ransomware

Not known

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.

Vendor, product

Acclaim Systems, USAHERDS

CISA name

Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

21 mo ago (2025-01-11)

17.44% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Weakness

• CWE-798 Use of Hard-coded Credentials

• acclaimsystems.com

  vendor-advisory

• github.com /mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0012/MNDT-2021-0012.md

  third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44207

  government-resource, us-government-resource

• CVE List CVE-2021-44207
• NVD CVE-2021-44207

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.