LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A dental imaging tool inherited a SYSTEM-level bug from an old SDK

MedDevice Cyber Staff · Jul 17 · 2 min read · Via CISA

Panoramic Digital Imaging Software 9.1.2.7600 got ICSMA-25-198-01. CVE-2024-22774, an uncontrolled search path, DLL hijacking, letting a standard local user climb to NT AUTHORITY\SYSTEM. Damian Semon Jr. of Blue Team Alpha reported it.

The origin matters more than the bug. It was inherited from an unsupported SDK component from another vendor. The dental imaging maker did not write it, but it shipped it, and its customers run it. Unsupported dependencies are unpatched dependencies, and when the upstream is dead its bugs become permanent unless you rip the component out.

Track the support status of every third-party component, not just its version. An end-of-life SDK will not fix itself, and its CVEs become yours to answer for.

Remediation Desk

Panoramic Digital Imaging Software inherited a DLL-hijack path from an unsupported third-party SDK, letting a standard user escalate to SYSTEM (ICSMA-25-198-01). Apply the fix and treat unsupported SDKs as a supply-chain liability that carries their bugs into your product.

Apply the vendor fix. Install the remediated version from ICSMA-25-198-01.
Replace the unsupported SDK. A component that no longer gets fixes keeps handing you its vulnerabilities; plan its removal.
Pin DLL load paths. Load libraries from trusted absolute paths so a planted DLL in a writable directory is never picked up.

Sources

CISA ↗

Questions & Answers

What is CVE-2024-22774 in Panoramic Digital Imaging Software?

An uncontrolled search path enabling DLL hijacking in version 9.1.2.7600, covered by ICSMA-25-198-01. A standard local user can escalate to NT AUTHORITY\SYSTEM. Damian Semon Jr. of Blue Team Alpha reported it.

Where did the Panoramic flaw come from?

An unsupported third-party SDK component. The vendor shipped code it did not write, and when the upstream is dead its bugs become permanent unless the component is removed. Support status of every dependency needs tracking, not just version.

← Back to Vulnerabilities