CISA advisory ICSMA-25-224-01 lands on Santesoft Sante PACS Server, the imaging archive, versions before 4.2.3. Five CVEs. Start with CVE-2025-53948, a double free that a crafted HL7 message turns into a denial of service on the archive itself, then CVE-2025-54156, where the web portal transmits credentials in cleartext. Add path traversal and two cross-site scripting bugs and you have arbitrary file creation, cookie theft and data disclosure, top base score 7.5.
Credentials that cross a network in cleartext are readable by anyone positioned to watch the traffic on the wire. Transport encryption solves the problem and has been standard for years, yet plaintext logins keep surfacing because an internal portal feels private to the people who build it. Treating the hospital network as a trusted interior, rather than a space an intruder eventually reaches, is the recurring mistake underneath the finding.
The double free belongs to a different class of defect, a memory-management error in which a program releases the same block twice and corrupts its own bookkeeping. Reaching it through a crafted message means the archive can be toppled by input it was built to accept. The messaging protocol that clinical systems use to exchange orders and results runs constantly across a hospital, so a parser that mishandles a hostile message meets the ordinary flow of that traffic rather than some exotic probe.
A PACS holds every image, and an attacker who can crash it or read its login traffic is inside the part of the network hospitals trust most. Chizuru Toyama of TXOne Networks reported it. Upgrade to 4.2.3, and if you ship anything that speaks HL7, treat the message parser as an attack surface, not plumbing.
An imaging archive occupies a central and trusted position, wired to modalities, workstations and records across departments. A single server that can be crashed, read or written to becomes a pivot toward everything connected to it. One product carrying distinct weaknesses across memory safety, transport and the web tier suggests it was never examined with an adversary in mind.