EUVD-2026-102894Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DICOM service over network
-
DeliveryOpen association with unregistered AE title
-
ExploitIssue C-FIND to enumerate patients
-
ExecutionC-GET to retrieve images, C-STORE to inject studies
-
ImpactExfiltrate PHI and falsify patient records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the dcm4chee-arc-light archive run in its default configuration, which accepts DICOM associations from unregistered/unknown calling AE titles, and that the attacker can reach the archive's DICOM application entity over the network (typically the DICOM TCP port such as 11112). No credentials, user interaction, or non-default settings are needed (PR:N/UI:N). The primary limiting factor is network reachability: archives deployed on isolated or firewalled clinical VLANs are only exploitable by peers with access to that segment, and the risk is eliminated by configuring AE title access control / rejecting unregistered called/calling AEs. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and CWE-306 (Missing Authentication for Critical Function) is consistent with the description: in the default configuration the archive accepts DICOM associations from unregistered calling AE titles. The high confidentiality and integrity impacts (VC:H/VI:H) are well supported - C-FIND/C-GET enable bulk exfiltration of patient data and images, and C-STORE allows fabricated studies to be filed under real patient identities, a patient-safety and data-integrity concern. No EPSS score, KEV listing, or POC availability was provided in the input, so exploitation likelihood cannot be quantified; exploitation status is therefore 'no public exploit identified at time of analysis.' The low technical barrier combined with a disclosure through a CISA ICS medical advisory elevates practical concern even without EPSS/KEV signals. One caveat: exposure depends on the DICOM service being network-reachable - many such archives sit on segmented clinical networks, which limits internet-wide mass exploitation (verify actual network exposure per deployment). |
| Exploit ScenarioDerived | An attacker with network access to the archive's DICOM port opens an association using an arbitrary, unregistered calling AE title, which the default configuration accepts without authentication. They issue C-FIND and C-GET to enumerate and download patient records and medical images, and can send C-STORE operations to inject fabricated study content under an existing patient's identity. No public exploit code was identified in the provided data, but the attack requires only a standard DICOM toolkit and no special conditions beyond network reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Unauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light archives left in their default configuration, because the DICOM listener accepts association requests from calling AE titles that were never registered. An attacker who can reach the archive's DICOM service (commonly TCP 11112) can use C-FIND and C-GET to enumerate and retrieve patient records, and C-STORE to file fabricated studies under an existing patient identity, corrupting the clinical record. Exploitation requires no credentials and no user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N); no public exploit code and no confirmed in-the-wild exploitation are identified at time of analysis, so the high severity is driven by the confidentiality and integrity impact on protected health information rather than by observed attacks.
Earlier versions of this analysis (1)
DCM4CHEE Arc Light, the open-source DICOM archive and VNA maintained by j4care, ships with a default configuration that accepts DICOM associations from any calling AE title without verifying that the peer is registered, allowing a remote unauthenticated attacker who can reach the archive's DICOM listener (commonly TCP 11112) to enumerate and download patient demographics and medical images via C-FIND and C-GET and to inject fabricated studies under an existing patient identity via C-STORE. The issue is a straight CWE-306 missing-authentication-for-critical-function flaw that scores CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting full loss of confidentiality and integrity with no authentication or user interaction required; there is no availability impact. At time of analysis there is no public exploit identified, and the practical exposure boundary is network reachability plus the default peer-trust setting - deployments that segment the imaging VLAN or enforce a registered AE allowlist are not exploitable, while internet- or enterprise-reachable archives left in the default state are. No KEV listing was provided in the available intelligence.
RemediationAI
No vendor-released patch is identified in the available data, and because the weakness is CWE-306 arising from default configuration rather than a coding defect, the primary remediation is to enable AE title access control on the archive - restrict accepted calling and called AE titles to the explicit list of known modalities, workstations and viewers, so that unregistered peers are rejected at association time. The trade-off is operational: any modality or integration not added to the allowlist will stop working, so inventory DICOM endpoints before enforcing the list. Complementary controls: firewall or ACL the DICOM port (commonly 11112) so only clinical VLANs and known modality IP addresses can reach the archive, which limits exposure but does not stop an attacker already positioned on that segment; segment the archive from general user networks and remote-access paths; enable DICOM audit logging and alerting on associations from unknown calling AE titles, C-FIND queries with unusually broad matching keys, and unexpected C-STORE operations, accepting that log review requires staffing; and apply integrity monitoring or periodic reconciliation of stored studies against source systems to detect fabricated content injected via C-STORE. Where the archive must be reachable more broadly, terminate DICOM traffic through a proxy that enforces AE title and IP allowlisting. Review CISA ICS medical advisory ICSMA-26-288-02 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02) for the vendor's current guidance and any updated patch or configuration information, and monitor the same advisory for changes before assuming the issue is resolved.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
dcm4chee-arc-light is an open-source DICOM archive/PACS built on the dcm4che Java toolkit and published by j4care; the CPE string cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* indicates the flaw is inherent to the product line rather than to one release. DICOM network communication begins with an association request in which the requesting party states a calling AE title and the archive states a called AE title; the CWE-306 (Missing Authentication for Critical Function) root cause is that the default configuration does not validate those AE titles against a registered allowlist, so any network peer that can open a TCP connection to the DICOM application entity is treated as a legitimate modality. Once the association is established, standard DIMSE services are exposed: C-FIND permits querying the patient/study/series hierarchy, C-GET permits retrieval of stored DICOM objects, and C-STORE permits submission of new objects, which is what allows an attacker both to exfiltrate imaging data and to inject fabricated studies into a real patient's record. The practical attack surface is the DICOM port itself (conventionally 11112), which means reachability to that port from the attacker's network position is the gating condition.
Know when Dcm4Chee Arc Light gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Unauthenticated network DICOM access in default config gives AV:N/AC:L/PR:N/UI:N; C-FIND/C-GET yield C:H and C-STORE fabrication yields I:H, with no availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
Executive ViewAI
dcm4chee-arc-light, a widely used medical imaging archive, in its default configuration exposes patient demographics and medical imagery to unauthenticated remote attackers. This critical vulnerability allows attackers to not only view but also corrupt clinical records by injecting fabricated studies, potentially leading to misdiagnosis and patient harm. Leadership should care because it directly threatens protected health information, regulatory compliance, and organizational reputation, with no vendor patch currently available.
No vendor-released patch identified at time of analysis; implement interim mitigations: restrict network access to DICOM service (TCP 11112) via firewall rules, enforce AE title whitelisting to reject unregistered calling AE titles, enable TLS with mutual authentication if supported, deploy DICOM-aware monitoring to detect unauthorized C-FIND/C-GET/C-STORE operations, and segment the DICOM network from general IT networks.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Dcm4Chee Arc Light
View allUnauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the stor
Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a r
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its Multipa
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-e
Exploit-DB