Vulnerabilities Identified in Orthanc Server and MicroDicom DICOM Viewer
Two vulnerabilities have been identified in DICOM medical imaging products – A critical vulnerability in the standalone DICOM server, Orthanc Server, and a medium-severity vulnerability in MicroDicom DICOM Viewer.
Critical Orthanc Server Vulnerability
A security researcher has identified a critical vulnerability in Orthanc Server that could be exploited by a threat actor to gain unauthorized access to the server. After successfully exploiting the flaw, an attacker could view or modify sensitive data on the server or cause a denial-of-service condition. The vulnerability, tracked as CVE-2025-0896, has a CVSS v3.1 base score of 9.8 (CVSS v4 9.2) and can be exploited remotely in a low-complexity attack. The vulnerability affects all Orthanc Server versions prior to version 1.5.8 and is due to basic authentication not being enabled by default when remote access is enabled.
The vulnerability was reported to Orthanc by researcher Amitay Dan and has been addressed in the latest version of the free-to-use open-source software. If an update is not immediately possible, users should enable HTTP authentication by setting “AuthenticationEnabled”: true in the configuration file.
Medium Severity MicroDicom DICOM Viewer Vulnerability
A medium-severity vulnerability has been identified in the MicroDicom DICOM Viewer. The vulnerability is tracked as CVE-2025-1002 and has been assigned a CVSS v3.1 base score of 5.7 (CVSS v4 5.7). The vulnerability is due to the failure to adequately verify the update server’s certificate. The vulnerability can be exploited in a low-complexity attack by an attacker in a privileged network position to alter traffic and conduct a machine-in-the-middle (MitM) attack. An attacker could potentially modify the server’s response and deliver a malicious update to the user.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The vulnerability affects MicroDicom DICOM Viewer version 2024.03 and has been fixed in version 2025.1. MicroDicom recommends updating to the latest version as soon as possible to prevent exploitation of the vulnerability. No evidence has been found to indicate any exploitation of either vulnerability as of the date of the security alerts. CISA recommends locating all control system networks behind firewalls and blocking remote access if it is not required. When remote access is required, secure methods should be used such as Virtual Private Networks (VPNs).
