J4Care dcm4che
Summary
Multiple vulnerabilities have been identified in J4Care dcm4chee-arc-light versions prior to 5.35.2, potentially allowing attackers to delete medical images, expose patient data, and inject forged studies. Successful exploitation could lead to significant data compromise and service disruption within healthcare systems worldwide. J4Care has released version 5.35.2 to address these security flaws.
IFF Assessment
The identified vulnerabilities in J4Care dcm4chee-arc-light pose a critical risk to patient data confidentiality, integrity, and availability, making it bad news for defenders.
Severity
The CVSS score of 9.1 indicates a CRITICAL severity, stemming from vulnerabilities such as Missing Authorization, Infinite Loop, Inefficient Algorithmic Complexity, and Missing Authentication. These issues allow for significant impact on confidentiality, integrity, and availability.
Defender Context
Defenders in the healthcare sector must prioritize patching or upgrading J4Care dcm4chee-arc-light systems to version 5.35.2 or later to mitigate these critical vulnerabilities. This incident highlights the importance of robust authorization checks and secure coding practices in medical imaging software, a sector with highly sensitive data.