A DICOM viewer that did not check its update server certificate

MedDevice Cyber Staff · Feb 20 · 2 min read · Via CISA

Medixant RadiAnt DICOM Viewer 2024.02 got ICSMA-25-051-01. CVE-2025-1001, improper certificate validation during software update. Sharon Brizinov of Claroty Team82 reported it.

Certificate validation is the step that lets a program confirm the machine answering an update request is the one the vendor actually runs, not an impostor on the same path. When that check is weak or absent, the encrypted connection still forms but proves only privacy, never identity, so a party sitting between the viewer and its update host can present its own server and be believed. The defect recurs because validation is easy to switch off in development and easy to leave off.

The update channel is the softest target in any product. If the viewer does not verify who it is talking to, an attacker in the middle hands it a malicious update and the product installs the attack itself. You do not need to breach the vendor if you can impersonate its update server to one clinic. Pin or properly validate the certificate on every update check. The auto-updater is a code-execution primitive you built on purpose.

On a radiology workstation the stakes are concrete. The viewer runs where clinicians open studies and reach reading decisions, so a package the software accepts on its own authority becomes code executing beside patient images. Reaching every site at once is unnecessary; one foothold on a clinic network or a shared wireless segment can feed a poisoned update to the machines that check in from there.

The finding travelled the coordinated route that now defines medical-device reporting, a researcher disclosing to a national coordinator and the vendor, followed by a published advisory and a corrected release. Lightweight imaging viewers occupy an awkward spot in that system, downloaded freely and installed widely, often outside formal procurement, so the software updating itself on a clinical desktop may never have passed the hospital's own security review.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

RadiAnt DICOM Viewer did not verify its update server TLS certificate (ICSMA-25-051-01), giving a man-in-the-middle attacker a path to deliver a malicious update. Update to the fixed version and, if you ship an updater, verify the certificate and sign the update payload.

Update to the fixed version. Apply the RadiAnt release that verifies the update server certificate, per ICSMA-25-051-01.
Verify the server certificate. An updater must validate the TLS certificate chain and reject a mismatch rather than proceeding.
Sign update payloads. Sign updates and verify the signature on the device so a tampered payload is rejected even if transport is compromised.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

sys_firmware_update net_cloud sys_ots_software app_user_accounts data_phi use_hospital_net net_wireless

EMB3D

PID-271 PID-2722 PID-273

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-1001 in RadiAnt DICOM Viewer?

Improper certificate validation in the update mechanism of version 2024.02, covered by ICSMA-25-051-01. The viewer did not verify the update server’s TLS certificate, so a man-in-the-middle could deliver a malicious update. Sharon Brizinov of Claroty Team82 reported it.

How dangerous is an unverified update channel?

It turns the product into its own infection vector. An attacker who can impersonate the update server to one clinic gets the application to install the payload itself, with no vendor breach required.

← Back to Vulnerabilities