LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Five flaws in Sante PACS Server, and one sends credentials in cleartext

MedDevice Cyber Staff · Aug 12 · 3 min read · Via CISA

CISA advisory ICSMA-25-224-01 lands on Santesoft Sante PACS Server, the imaging archive, versions before 4.2.3. Five CVEs. Start with CVE-2025-53948, a double free that a crafted HL7 message turns into a denial of service on the archive itself, then CVE-2025-54156, where the web portal transmits credentials in cleartext. Add path traversal and two cross-site scripting bugs and you have arbitrary file creation, cookie theft and data disclosure, top base score 7.5.

A PACS holds every image, and an attacker who can crash it or read its login traffic is inside the part of the network hospitals trust most. Chizuru Toyama of TXOne Networks reported it. Upgrade to 4.2.3, and if you ship anything that speaks HL7, treat the message parser as an attack surface, not plumbing.

Remediation Desk

ICSMA-25-224-01 covers five bugs in Sante PACS Server before 4.2.3, including a double free that crashes the archive on a crafted HL7 message and a web portal that sends credentials in the clear. Update past 4.2.3, enable transport encryption, and validate HL7 input before it reaches the parser.

Update past 4.2.3. Move to the fixed Sante PACS Server release from ICSMA-25-224-01.
Encrypt the portal. Put the web portal behind TLS so credentials are never transmitted in cleartext.
Validate HL7 messages. Reject malformed HL7 at the boundary so a crafted message cannot reach the double-free path in the archive.

Sources

CISA ↗

Questions & Answers

What does ICSMA-25-224-01 cover in Sante PACS Server?

Five CVEs in versions before 4.2.3, led by CVE-2025-53948, a double free that a crafted HL7 message turns into denial of service on the archive, and CVE-2025-54156, a web portal transmitting credentials in cleartext, plus path traversal and two cross-site scripting bugs. Top base score 7.5.

What is the fix for the Sante PACS Server flaws?

Upgrade to 4.2.3. Chizuru Toyama of TXOne Networks reported the findings, and anything that parses HL7 should be treated as attack surface.

← Back to Vulnerabilities