Vulnerability

OFFIS DCMTK before 3.6.7 lets attackers write DICOM files into arbitrary directories

MedDevice Cyber Staff · Jun 23 · 3 min read · Via CISA ICSMA-22-174-01

CISA published advisory ICSMA-22-174-01 on June 23, 2022, covering OFFIS DCMTK versions before 3.6.7. Noam Moshe of Claroty reported three vulnerabilities in the open-source DICOM toolkit.

CVE-2022-2119 (CWE-22) and CVE-2022-2120 (CWE-23) each score 7.5 under CVSS v3. The first sits in the service class provider (SCP), the receiving side; the second in the service class user (SCU), the sending side. Both let an attacker write DICOM files into arbitrary directories under controlled names, which CISA says could allow remote code execution. CVE-2022-2121 (CWE-476, 6.5) is a NULL pointer dereference while processing DICOM files that can cause a denial of service.

All three vectors are adjacent network, so the attacker needs a foothold on the imaging network. DICOM traffic lives on that network anyway. A path-controlled file write on a node that accepts studies from modalities is the classic route from a dropped file to code execution.

OFFIS recommends all users update to Version 3.6.7 or later, tracked as Bug #1021. The fix only reaches patients once every product that bundles DCMTK ships it, so manufacturers need to find the library in their SBOMs and rebuild.

Are you a representative of a manufacturer named here? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update OFFIS DCMTK to Version 3.6.7 or later, which fixes CVE-2022-2119, CVE-2022-2120 and CVE-2022-2121. Manufacturers that embed DCMTK must rebuild and ship updated products; operators should ask their vendors whether their imaging systems include DCMTK and when the fix arrives. Restrict which hosts can send DICOM traffic to affected nodes in the meantime.

Upgrade to DCMTK 3.6.7. Move every direct use of DCMTK to 3.6.7 or later.
Search SBOMs for DCMTK. Identify every product that bundles the toolkit and schedule a rebuild with the fixed version.
Limit DICOM peers. Accept DICOM associations only from known modalities and archives, since the attacker needs adjacent network access.
Confine the storage path. Run DICOM services with write access limited to the intended storage directory.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

DICOM or image parsing

Contributing

Off-the-shelf software File import Hospital network

DCMTK

PID-41 DICOM or image parsing Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What version of OFFIS DCMTK fixes CVE-2022-2119?

OFFIS recommends updating DCMTK to Version 3.6.7 or later. CISA advisory ICSMA-22-174-01, published June 23, 2022, lists all versions before 3.6.7 as affected by CVE-2022-2119, CVE-2022-2120 and CVE-2022-2121.

How can CVE-2022-2120 in DCMTK lead to remote code execution?

Per CISA advisory ICSMA-22-174-01, CVE-2022-2120 is a relative path traversal in the OFFIS DCMTK service class user (SCU) that lets an attacker write DICOM files into arbitrary directories under controlled names, which could allow remote code execution. It scores 7.5 under CVSS v3.

Who discovered the OFFIS DCMTK path traversal vulnerabilities?

CISA advisory ICSMA-22-174-01 credits Noam Moshe of Claroty with reporting CVE-2022-2119, CVE-2022-2120 and CVE-2022-2121 in OFFIS DCMTK before 3.6.7.

← Back to Vulnerabilities