LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A DICOM viewer that did not check its update server certificate

MedDevice Cyber Staff · Feb 20 · 2 min read · Via CISA

Medixant RadiAnt DICOM Viewer 2024.02 got ICSMA-25-051-01. CVE-2025-1001, improper certificate validation during software update. Sharon Brizinov of Claroty Team82 reported it.

The update channel is the softest target in any product. If the viewer does not verify who it is talking to, an attacker in the middle hands it a malicious update and the product installs the attack itself. You do not need to breach the vendor if you can impersonate its update server to one clinic. Pin or properly validate the certificate on every update check. The auto-updater is a code-execution primitive you built on purpose.

Remediation Desk

RadiAnt DICOM Viewer did not verify its update server TLS certificate (ICSMA-25-051-01), giving a man-in-the-middle attacker a path to deliver a malicious update. Update to the fixed version and, if you ship an updater, verify the certificate and sign the update payload.

Update to the fixed version. Apply the RadiAnt release that verifies the update server certificate, per ICSMA-25-051-01.
Verify the server certificate. An updater must validate the TLS certificate chain and reject a mismatch rather than proceeding.
Sign update payloads. Sign updates and verify the signature on the device so a tampered payload is rejected even if transport is compromised.

Sources

CISA ↗

Questions & Answers

What is CVE-2025-1001 in RadiAnt DICOM Viewer?

Improper certificate validation in the update mechanism of version 2024.02, covered by ICSMA-25-051-01. The viewer did not verify the update server’s TLS certificate, so a man-in-the-middle could deliver a malicious update. Sharon Brizinov of Claroty Team82 reported it.

How dangerous is an unverified update channel?

It turns the product into its own infection vector. An attacker who can impersonate the update server to one clinic gets the application to install the payload itself, with no vendor breach required.

← Back to Vulnerabilities