Vulnerability

MicroDicom DICOM Viewer lets a crafted link read or plant medical images

MedDevice Cyber Staff · Jun 11 · 3 min read · Via CISA ICSMA-24-163-01

CISA published advisory ICSMA-24-163-01 on June 11, 2024, for MicroDicom DICOM Viewer versions earlier than 2024.2. Michael Heinzl reported two vulnerabilities, each with a CVSS v3.1 base score of 8.8.

CVE-2024-33606 (CWE-939) is improper authorization in the viewer's handler for a custom URL scheme. An attacker can retrieve medical images from the victim's system, plant new ones, or overwrite existing ones. The user has to interact, typically by opening a link, but the attacker needs no privileges and can be remote.

Image integrity is the clinical problem here. A planted or overwritten study looks like any other file to the clinician reading it.

CVE-2024-28877 (CWE-121) is a stack-based buffer overflow that may allow arbitrary code execution on affected installations, again with user interaction required. CISA's risk summary combines the two: sensitive information disclosure plus code execution on the workstation.

MicroDicom recommends upgrading to DICOM Viewer 2024.2. A URL handler registered with the operating system is a remote entry point, and every action it can trigger needs the same authorization checks as the main interface.

Are you a representative of MicroDicom? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade MicroDicom DICOM Viewer to 2024.2 on every workstation. Until then, tell users not to open DICOM viewer links from email or the web. Where the viewer is not needed for link handling, remove its custom URL scheme registration.

Upgrade to 2024.2. Replace every MicroDicom DICOM Viewer install older than 2024.2.
Warn users about links. Both CVEs need user interaction, so untrusted links and files are the delivery path.
Audit URL handlers. Review custom URL scheme registrations on imaging workstations and remove those not in use.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Handles patient data DICOM or image parsing

DICOM Viewer

Handles patient data DICOM or image parsing

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2024-33606 in MicroDicom DICOM Viewer?

CVE-2024-33606 is improper authorization in a custom URL scheme handler (CWE-939, CVSS v3.1 8.8) in MicroDicom DICOM Viewer before 2024.2. With user interaction, an attacker can retrieve, plant or overwrite medical images on the victim's system. CISA disclosed it in advisory ICSMA-24-163-01 on June 11, 2024.

How do I fix the MicroDicom DICOM Viewer vulnerabilities?

Upgrade to MicroDicom DICOM Viewer 2024.2, which addresses CVE-2024-33606 and CVE-2024-28877, per CISA advisory ICSMA-24-163-01.

← Back to Vulnerabilities