Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical vulnerability in the default configuration of certain archive systems that accept medical imaging data. An unauthorized remote attacker could potentially access and retrieve patient information and medical images, or inject fabricated study content under existing patient identities. The primary concern is confirming if this specific technology is in use and if it is exposed to unauthorized access.
- Unauthorized access to patient data.
- Critical risk if in use and exposed.
- Confirm relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker can target the default configuration of the DICOM archive, which allows connections from any source. By establishing a DICOM association, the attacker can interact with the archive to discover and access patient information and medical images. Additionally, they can insert fabricated data into existing patient records.
- No specific entry conditions are required.
- Use C-FIND, C-GET, or C-STORE commands.
- Unauthorized access to sensitive patient data.
Live Threat
Current exploitation, exposure, and threat context
In its default configuration, this archive accepts connections from any source, allowing remote attackers to access patient information and medical images. Additionally, an attacker could insert fabricated study content into existing patient records.
- Patient data and medical images at risk.
- Remote peer can enumerate and retrieve data.
- Unauthorized filing of fabricated study content.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts DICOM archive services, likely managed by dedicated IT or biomedical engineering teams responsible for medical imaging infrastructure. The initial step is to locate all instances of the affected DICOM archive technology, confirm their network exposure and criticality to patient care, identify the system owners, and then prioritize remediation based on risk assessment.
- Ownership: Biomedical engineering and IT infrastructure teams.
- Verify first: Network exposure and patient data criticality.
- Action: Plan risk-based remediation and vendor coordination.
