LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

An open-source DICOM server that shipped with auth off by default

MedDevice Cyber Staff · Feb 6 · 3 min read · Via CISA

The default was the vulnerability. Orthanc Server, the widely embedded open-source DICOM server, drew ICSMA-25-037-02 for versions before 1.5.8. CVE-2025-0896, missing authentication for a critical function, base score 9.8.

Expose the remote HTTP interface without explicitly setting AuthenticationEnabled to true, and an unauthenticated attacker could read or modify imaging records or knock the service over. The people who integrate Orthanc into a product inherit that default unless they know to change it, and most integration guides never mention it.

This is separate from the nine-CVE Orthanc note that came a year later. Same server, two advisories, one lesson: ship secure by default, because the default is what most deployments run forever.

Remediation Desk

Orthanc Server before 1.5.8 did not enable authentication by default when the HTTP interface was exposed (ICSMA-25-037-02), leaving imaging records reachable to any unauthenticated attacker. Update past 1.5.8, turn authentication on, and confirm no instance is exposed without it.

Update past 1.5.8. Move to the Orthanc release that closes the default-no-auth behavior.
Require authentication. Enable authentication on the HTTP interface and verify it is enforced, not just configured.
Ship secure by default. An exposed interface should require authentication out of the box, never rely on an operator knowing to switch it on.

Sources

CISA ↗

Questions & Answers

What is CVE-2025-0896 in Orthanc Server?

Missing authentication for a critical function, base score 9.8, in versions before 1.5.8. With the remote HTTP interface exposed and AuthenticationEnabled not explicitly set to true, an unauthenticated attacker could read or modify imaging records or take the service down.

Who is affected by the Orthanc default?

Any deployment that exposed the HTTP interface without turning authentication on, including commercial products that embed Orthanc. Integrators inherit the default unless they know to change it.

← Back to Vulnerabilities