PT-2025-15880 · Meddream · Web Dicom Viewer+1

Published 2025-04-09 · Updated 2025-08-15 · CVE-2025-3480

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MedDream WEB DICOM Viewer (affected versions not specified)

Description This issue allows network-adjacent attackers to disclose sensitive information on affected installations. The flaw exists within the Web Portal due to the lack of encryption when transmitting credentials. An attacker can leverage this to disclose transmitted credentials, leading to further compromise. Authentication is not required to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-522

CWE-319

Related Identifiers

CVE-2025-3480

ZDI-25-246

Affected Products

Web Dicom Viewer

Pacs Server

References · 6

• https://zerodayinitiative.com/advisories/ZDI-25-246 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3480 · Security Note
• https://t.me/cveNotify/132476 · Telegram Post
• https://twitter.com/BaseFortify/status/1925459382831038861 · Twitter Post
• https://twitter.com/CVEnew/status/1925384173562601597 · Twitter Post