// For flags

CVE-2024-33606

MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme

Severity Score

8.6
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability.

Un atacante podría recuperar archivos confidenciales (imágenes médicas), así como colocar nuevas imágenes médicas o sobrescribir imágenes médicas existentes en un sistema MicroDicom DICOM Viewer. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad.

*Credits: Michael Heinzl reported these vulnerabilities to CISA.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
System
Vulnerable | Subsequent
Confidentiality
High
None
Integrity
High
None
Availability
High
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-05-23 CVE Reserved
  • 2024-06-11 CVE Published
  • 2024-08-02 CVE Updated
  • 2025-03-01 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-939: Improper Authorization in Handler for Custom URL Scheme
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microdicom
Search vendor "Microdicom"
 Dicom Viewer
Search vendor "Microdicom" for product "Dicom Viewer"
*-
Affected