CVE-2025-1002

March 3, 2025, 5:24 p.m.

5.7
Medium

Description

MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle (MITM) attack. This allows the attackers to modify the server's response and deliver a malicious update to the user.

Product(s) Impacted

Vendor Product Versions
Microdicom
  • Dicom Viewer
  • 2024.3

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a microdicom dicom_viewer 2024.3 / / / / / / /

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-01

Tags

ics-cert@hq.dhs.gov
CWE-295
2025-02-10
CVE-2025-1002

CVSS Score

5.7 / 10

CVSS Data

  • Attack Vector: ADJACENT_NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: HIGH
  • Availability Impact: NONE
    • View Vector String

    CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Date

  • Published: Feb. 10, 2025, 9:15 p.m.
  • Last Modified: March 3, 2025, 5:24 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

ics-cert@hq.dhs.gov

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.