// For flags

CVE-2025-1002

MicroDicom DICOM Viewer Improper Certificate Validation

Severity Score

5.7
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle (MITM) attack. This allows the attackers to modify the server's response and deliver a malicious update to the user.

La versión 2024.03 de MicroDicom DICOM Viewer no verifica adecuadamente el certificado del servidor de actualización, lo que podría permitir a los atacantes en una posición privilegiada de la red alterar el tráfico de la red y llevar a cabo un ataque de tipo máquina intermedia (MITM). Esto permite a los atacantes modificar la respuesta del servidor y entregar una actualización maliciosa al usuario.

MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle (MITM) attack. This allows the attackers to modify the server's response and deliver a malicious update to the user.

*Credits: Sharon Brizinov of Claroty Team82 reported this vulnerability to CISA.
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Active
System
Vulnerable | Subsequent
Confidentiality
None
None
Integrity
High
None
Availability
None
None
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Complete
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2025-02-03 CVE Reserved
  • 2025-02-10 CVE Published
  • 2025-02-10 CVE Updated
  • 2025-02-11 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microdicom
Search vendor "Microdicom"
 Dicom Viewer
Search vendor "Microdicom" for product "Dicom Viewer"
*-
Affected