Vulnerability

Softneta MedDream PACS allows unauthenticated remote code execution

MedDevice Cyber Staff · Sep 5 · 2 min read · Via CISA ICSMA-23-248-01

CISA published advisory ICSMA-23-248-01 on September 5, 2023, covering two vulnerabilities in Softneta MedDream PACS Premium, versions 7.2.8.810 and prior. Noam Moshe of Claroty Research reported them.

CVE-2023-40150 (CWE-749, CVSS v3 9.8) is an exposed dangerous function. The product performs dangerous functionality without an authentication check, which could give an attacker unauthenticated remote code execution on the PACS server. CVE-2023-39227 (CWE-256, CVSS 6.1) is plaintext storage of usernames and passwords, which turns any foothold into a list of working logins.

Softneta recommends updating to MedDream PACS Server 7.2.9.820, or patching the current install with Fix-v230712.

Every server function that changes state needs an authentication check in front of it, and plaintext passwords should have been retired a decade before this release.

Are you a representative of Softneta? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update MedDream PACS Server to 7.2.9.820 or apply Fix-v230712. Then reset every MedDream user password, since CVE-2023-39227 stored them in plaintext, and keep the PACS unreachable from untrusted networks.

Install 7.2.9.820 or Fix-v230712. Either closes the unauthenticated remote code execution flaw.
Reset all passwords. Assume stored credentials were readable and require new ones for every account.
Restrict network access. Allow connections to the PACS only from known modalities and workstations.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

DICOM or image parsing Web interface Hospital network

MedDream PACS Premium

PID-331 PID-3321 User accounts

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same signals	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
ID NOW COVID-19 2.0	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Embryo Predict	Alife Health	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
Image Suite	Carestream Health	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
MOSAIQ Oncology Information System	Elekta	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer

27 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2023-40150 in Softneta MedDream PACS?

CVE-2023-40150 (CWE-749, CVSS v3 9.8) is an exposed dangerous function in Softneta MedDream PACS 7.2.8.810 and prior that runs without an authentication check and could allow unauthenticated remote code execution. CISA published it as ICSMA-23-248-01 on September 5, 2023.

How do I fix CVE-2023-40150 and CVE-2023-39227 in MedDream PACS?

Softneta recommends updating MedDream PACS Server to 7.2.9.820 or applying Fix-v230712 to the current install, per CISA advisory ICSMA-23-248-01 from September 5, 2023.

← Back to Vulnerabilities