PT-2025-5866 · Unknown · Orthanc Dicom Server

Amitay Dan + 1 · Published 2025-02-06 · Updated 2025-07-30 · CVE-2025-0896

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Orthanc DICOM Server versions prior to 1.5.8

Description The issue allows unauthorized access to medical images due to missing authentication. This exposes medical data to potential unauthorized access. Remote attackers can exploit this to access medical data without authentication.

Recommendations For Orthanc DICOM Server versions prior to 1.5.8, update to version 1.5.8 or enable HTTP authentication to secure your systems.

Fix

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

Related Identifiers

BDU:2026-00106

CVE-2025-0896

Affected Products

Orthanc Dicom Server

References · 32

• https://nvd.nist.gov/vuln/detail/CVE-2025-0896 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-0896 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0896 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00106 · Security Note
• https://ubuntu.com/security/CVE-2025-0896 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-0896 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0896 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-0896 · Security Note
• https://twitter.com/transilienceai/status/1888561477121892602 · Twitter Post
• https://t.me/pentestingnews/56316 · Telegram Post
• https://twitter.com/transilienceai/status/1889105602963452226 · Twitter Post
• https://twitter.com/HackerMigh32064/status/1889339429745295850 · Twitter Post
• https://twitter.com/transilienceai/status/1888379712608588125 · Twitter Post
• https://twitter.com/transilienceai/status/1889500819248287885 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1888953425796161894 · Twitter Post