Vulnerability DatabaseCVE-2024-33606

CVE-2024-33606:
MicroDicom DICOM Viewer vulnerability analysis and mitigation

Overview

CVE-2024-33606 is a critical vulnerability affecting MicroDicom DICOM Viewer versions prior to 2024.2. The vulnerability involves improper authorization in the handler for custom URL scheme, allowing attackers to retrieve and manipulate medical image files on victim systems. Discovered and reported by Michael Heinzl to CISA, this vulnerability was disclosed on June 11, 2024. The vulnerability has received a CVSS v3.1 base score of 8.8 and a CVSS v4.0 score of 8.6, indicating high severity (CISA Advisory).

Technical details

The vulnerability is classified as CWE-939 (Improper Authorization in Handler for Custom URL Scheme) and CWE-862 (Missing Authorization). The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires user interaction (UI:R). The vulnerability has received a CVSS v3.1 vector string of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and a CVSS v4.0 vector string of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (NVD Database).

Impact

Successful exploitation of this vulnerability could allow an attacker to retrieve sensitive medical image files, plant new medical images, or overwrite existing medical images on a victim's system. The vulnerability affects healthcare organizations worldwide, as the affected software is used for viewing medical images (CISA Advisory).

Mitigation and workarounds

MicroDicom recommends users upgrade to DICOM Viewer version 2024.2. CISA advises organizations to minimize network exposure for all control system devices, ensure they are not accessible from the internet, locate control systems behind firewalls, isolate them from business networks, and use secure methods like VPNs when remote access is required (CISA Advisory).