The Sante PACS Server is vulnerable to a denial-of-service condition that can be triggered by a remote attacker sending a specially crafted HL7 message. This vulnerability allows the attacker to crash the main thread of the application, necessitating a manual restart. Importantly, no authentication is required to exploit this vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-53948 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted HL7 message to the Sante PACS Server over the network. This message is designed to crash the main thread of the application, leading to a denial-of-service condition. Since no authentication is required, this attack can be executed remotely without any prior access.
Affected Products
- Sante PACS Server: A medical imaging solution that is susceptible to denial-of-service attacks due to improper handling of HL7 messages.
Mitigation
To mitigate this vulnerability, it is recommended that users of the Sante PACS Server implement network security measures to restrict access to the server. Additionally, keeping the software updated and monitoring for unusual traffic patterns can help prevent exploitation.