LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

DLL hijack escalates a standard user to SYSTEM on dental imaging software

MedDevice Cyber Staff · Dec 11 · 2 min read · Via CISA

Varex Imaging and Panoramic Corporation got ICSMA-25-345-02 for dental imaging software before 6.6.1.490. CVE-2024-22774, an uncontrolled search path element in ccsservice.exe, or in plain name, DLL hijacking. A standard user drops a malicious DLL where the service looks for it and rides it up to NT AUTHORITY\SYSTEM. CVSS v4 8.5.

It sounds mild until you remember shared clinical workstations rarely give each user their own machine. Damian Semon Jr. of Blue Team Alpha reported it. If your Windows service loads libraries by name, pin the path. The default search order is an attacker convenience.

Remediation Desk

An uncontrolled search path in Varex/Panoramic dental imaging software let a standard user escalate to SYSTEM through ccsservice.exe (ICSMA-25-345-02). Apply the fix and, if you ship Windows services, load libraries from fixed absolute paths only.

Apply the vendor fix. Install the remediated version from ICSMA-25-345-02.
Pin library load paths. A service should load DLLs from fully-qualified trusted paths, never from a working directory a standard user can write.
Restrict write access near the service. Remove user-writable directories from the service's search path so a planted DLL has nowhere to sit.

Sources

CISA ↗

Questions & Answers

What does CVE-2024-22774 let an attacker do?

An uncontrolled search path in Varex and Panoramic dental imaging software lets a standard user load their own DLL and escalate to SYSTEM through the ccsservice component.

Is this remote or local?

Local. The attacker already needs an account on the machine. The value to them is turning limited access into full control of the workstation.

How do you close it?

Apply the fixed build named in ICSMA-25-345-02 and tighten write permissions on the directories the service searches, so a low-privilege user cannot drop a DLL where it will be picked up.

← Back to Vulnerabilities