CVE-2025-1002 - MicroDicom DICOM Viewer Improper Certificate Validation · CoreCVE

Back Back to CVE browser

MEDIUM

MicroDicom DICOM Viewer Improper Certificate Validation

Published Feb 10, 2025

5.7

MEDIUM

CVSS 4.0

EPSS 0.11%

Description

MicroDicom DICOM Viewer version 2024.03

fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle (MITM) attack. This allows the attackers to modify the server's response and deliver a malicious update to the user.

Affected products

Vendor MicroDicom Product DICOM Viewer Default
unaffected
- Version
  2024.03
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
2024.03	affected	-

Remediation

Vendor solution

MicroDicom recommends users upgrade to DICOM Viewer version 2025.1 https://www.microdicom.com/downloads.html .

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (1)

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-01
Third Party AdvisoryUS Government Resource

Link	Providers	Tags
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-01		Third Party AdvisoryUS Government Resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Feb 10, 2025

Updated Feb 10, 2025

Reserved Feb 3, 2025

Link CVE-2025-1002

CISA Vulnrichment

Updated Feb 10, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-1002

Severity n/a

Public date n/a

Links CVE-2025-1002