Vulnerability

MicroDicom DICOM Viewer 2024.03 fails to validate its update server certificate

MedDevice Cyber Staff · Feb 6 · 2 min read · Via CISA ICSMA-25-037-01

CISA published advisory ICSMA-25-037-01 on February 6, 2025, covering CVE-2025-1002 in MicroDicom DICOM Viewer version 2024.03. Sharon Brizinov of Claroty Team82 reported it.

The viewer fails to adequately verify the update server's certificate (CWE-295). An attacker in a privileged network position can alter the traffic, modify the server's response and deliver a malicious update to the user.

CVSS v3.1 puts it at 5.7. The vector needs an adjacent network position and user interaction, and rates integrity impact high. CISA says it is not exploitable remotely and reported no known public exploitation.

MicroDicom recommends upgrading to DICOM Viewer version 2025.1. This is the viewer's second CISA advisory in under a year, after ICSMA-24-060-01 in February 2024 covered memory corruption in DCM file parsing.

An updater that trusts any certificate is a delivery channel for whoever sits on the network path. Pin the update server and sign the package, so either check alone stops a swapped binary.

Are you a representative of MicroDicom? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade MicroDicom DICOM Viewer to version 2025.1, which addresses CVE-2025-1002. Until then, avoid running the viewer's update check from untrusted or shared networks, since the attack needs a privileged network position.

Upgrade to 2025.1. MicroDicom recommends DICOM Viewer 2025.1 to fix the update certificate check.
Update only from trusted networks. The attacker must sit on the network path, so do not run updates over guest or public networks.
Verify certificates and signatures. Software makers should validate the update server certificate and require a signed package before installing anything.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Field-updatable firmware

DICOM Viewer

PID-27 Field-updatable firmware

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
EnSite Precision Cardiac Mapping System v2.6	Abbott	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
BD Vaginal Panel	BD	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
XIDF-AWS801, Angio Workstation (Alphenix Workstation), V9.3	Canon Medical	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
CoroFlow Cardiovascular System	Coroventis Research	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Vigilant Software Suite - Vigilant Master Med	Fresenius Kabi	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Automated Aortic Stenosis Software	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Deep Learning Image Reconstruction	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Definium Pace Select	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
LOGIQ E10s, LOGIQ Fortis	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
LOGIQ Fortis	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
MaxFOV 2	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Spine Auto Views	GE HealthCare	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer
Aptima HCV Quant Dx Assay	Hologic	Same property (MITRE EMB3D)PID-27	No feedback feed from manufacturer

25 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2025-1002 in MicroDicom DICOM Viewer?

CVE-2025-1002 (CVSS 5.7) is improper certificate validation in MicroDicom DICOM Viewer 2024.03: the viewer does not adequately verify its update server's certificate, so an attacker in a privileged network position could deliver a malicious update. CISA covered it in advisory ICSMA-25-037-01 on February 6, 2025.

How do I fix the MicroDicom DICOM Viewer update vulnerability CVE-2025-1002?

Upgrade to MicroDicom DICOM Viewer version 2025.1, which MicroDicom recommends to address CVE-2025-1002, per CISA advisory ICSMA-25-037-01.

Who discovered CVE-2025-1002 in MicroDicom DICOM Viewer?

Sharon Brizinov of Claroty Team82 reported CVE-2025-1002, the update server certificate validation flaw in MicroDicom DICOM Viewer 2024.03, per CISA advisory ICSMA-25-037-01 of February 6, 2025.

← Back to Vulnerabilities