DLL hijack escalates a standard user to SYSTEM on dental imaging software

MedDevice Cyber Staff · Dec 11 · 2 min read · Via CISA

Varex Imaging and Panoramic Corporation got ICSMA-25-345-02 for dental imaging software before 6.6.1.490. CVE-2024-22774, an uncontrolled search path element in ccsservice.exe, or in plain name, DLL hijacking. A standard user drops a malicious DLL where the service looks for it and rides it up to NT AUTHORITY\SYSTEM. CVSS v4 8.5.

Uncontrolled search path weaknesses trace back to how the Windows loader resolves a library requested by name. The operating system walks an ordered list of directories looking for a matching file, and a program that names a dependency without pinning its full location can be steered toward whatever copy appears first. A standard account able to write to one of those earlier directories controls what code the privileged process loads.

The escalation is what gives the finding its weight. Imaging services on clinical Windows machines frequently run under the most privileged system account so they can reach hardware and shared storage without prompting, which means a library planted by an ordinary user executes with that same reach. On a dental imaging station the captured radiographs, the stored studies and the credentials cached on the box all sit inside that boundary.

It sounds mild until you remember shared clinical workstations rarely give each user their own machine. Damian Semon Jr. of Blue Team Alpha reported it. If your Windows service loads libraries by name, pin the path. The default search order is an attacker convenience.

Local privilege-escalation findings like this one usually emerge from a security firm's hands-on assessment rather than from a failure noticed in the clinic, since nothing visibly breaks while the flaw sits in the loader's default behavior. They reach practices through a coordinated advisory that names the affected software and the corrected build, the standard route for turning a quiet weakness into something a buyer can act on.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

An uncontrolled search path in Varex/Panoramic dental imaging software let a standard user escalate to SYSTEM through ccsservice.exe (ICSMA-25-345-02). Apply the fix and, if you ship Windows services, load libraries from fixed absolute paths only.

Apply the vendor fix. Install the remediated version from ICSMA-25-345-02.
Pin library load paths. A service should load DLLs from fully-qualified trusted paths, never from a working directory a standard user can write.
Restrict write access near the service. Remove user-writable directories from the service's search path so a planted DLL has nowhere to sit.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

sys_named_os sys_ots_software app_user_accounts use_hospital_net data_phi net_remote_access

EMB3D

PID-2321 PID-23221

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What does CVE-2024-22774 let an attacker do?

An uncontrolled search path in Varex and Panoramic dental imaging software lets a standard user load their own DLL and escalate to SYSTEM through the ccsservice component.

Is this remote or local?

Local. The attacker already needs an account on the machine. The value to them is turning limited access into full control of the workstation.

How do you close it?

Apply the fixed build named in ICSMA-25-345-02 and tighten write permissions on the directories the service searches, so a low-privilege user cannot drop a DLL where it will be picked up.

← Back to Vulnerabilities