Vulnerability Identified in FujiFilm Synapse Mobility Medical Image Viewer
A medium-severity privilege escalation vulnerability has been identified in FujiFilm Healthcare Americas Synapse Mobility medical image viewing software that could be exploited to bypass authentication and access sensitive data.
The vulnerability is tracked as CVE-2025-54551 and affects all versions of Fujifilm Healthcare Americas Synapse Mobility prior to version 8.2 (Versions 8.0, 8.0.1, 8.0.2, 8.1, 8.1.1). The vulnerability is remotely exploitable in a low complexity attack and can allow an attacker to escalate privileges and access data that they do not have permission to view. Authenticated user interaction is required to exploit the vulnerability.
The vulnerability is due to external control of a Web parameter and can be exploited by altering the parameters of the search function, thereby providing results beyond the intended design of role-based access controls. The vulnerability has been assigned a CVSS v4 base score of 5.3 and a CVSS v3.1 base score of 4.3.
Fujifilm Healthcare Americas has fixed the vulnerability in version 8.2 and later versions and has released patches for versions 8.0 to 8.1.1. Users are encouraged to upgrade to the latest version of the software and ensure that patches are applied before the end-of-support date. If the version in use is past the end-of-support date, users should ensure they update to a supported version.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
If an immediate upgrade is not possible, administrators should consider disabling the search function in the configurator settings until the software can be updated. This can be achieved by unchecking the “Allow plain text accession number” checkbox in the security section of the admin interface. This will limit the site to use of the product only via the SecureURL feature.
