PT-2023-27296 · Softneta · Meddream Pacs

​Noam Moshe · Published 2023-09-11 · Updated 2024-02-20 · CVE-2023-40150

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Softneta MedDream PACS (affected versions not specified)

Description The issue concerns a lack of authentication check in the affected product, leading to the performance of dangerous functionality. This could result in unauthenticated remote code execution. A proof-of-concept exploit has been demonstrated, showing how an attacker could gain pre-authentication remote code execution on a PACS server and replace a DICOM study. The estimated number of potentially affected devices worldwide is not specified. However, it is mentioned that a healthcare data breach report found that almost 12 million people were affected by a leak due to a PACS server hack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-749

Related Identifiers

CVE-2023-40150

Affected Products

Meddream Pacs

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-40150 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40150 · Vendor Advisory
• https://twitter.com/Batglitch/status/1739583014802174059 · Twitter Post
• https://twitter.com/MedigateLtd/status/1733233742330630258 · Twitter Post
• https://twitter.com/CVEnew/status/1701312808724357605 · Twitter Post
• https://t.me/s_e_reborn/4535 · Telegram Post
• https://twitter.com/MedigateLtd/status/1748169658744586675 · Twitter Post
• https://twitter.com/MedigateLtd/status/1737096694007771575 · Twitter Post
• https://twitter.com/cracbot/status/1701475790666559533 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01 · Note