CVE-2023-40150 - OpenCVE

Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Softneta	Meddream Pacs

Configuration 1 [-]

cpe:2.3:a:softneta:meddream_pacs:*:*:*:*:premium:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01

History

Thu, 26 Sep 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-09-11T19:05:00.754Z

Updated: 2024-09-26T14:31:10.863Z

Reserved: 2023-08-18T16:28:34.426Z

Link: CVE-2023-40150

Vulnrichment

Updated: 2024-08-02T18:24:55.602Z

NVD

Status : Modified

Published: 2023-09-11T20:15:10.250

Modified: 2023-11-07T04:20:07.803

Link: CVE-2023-40150

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40150", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-08-18T16:28:34.426Z", "datePublished": "2023-09-11T19:05:00.754Z", "dateUpdated": "2024-09-26T14:31:10.863Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MedDream PACS", "vendor": "Softneta", "versions": [{"lessThanOrEqual": " v7.2.8.810", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "\u200bNoam Moshe of Claroty Research reported these vulnerabilities to CISA."}], "datePublic": "2023-09-05T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0</span>"}], "value": "\nSoftneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "description": "CWE-749 Exposed Dangerous Method or Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-09-11T19:09:00.487Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>\u200bSoftneta recommends users update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe\">v7.2.9.820</a> of MedDream PACS Server or patch their current system using <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip\">Fix-v230712</a>.</p><p>\u200bFor assistance or additional information about installing the software, please <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/contacts/\">contact Softneta</a> directly.</p>\n\n<br>"}], "value": "\n\u200bSoftneta recommends users update to v7.2.9.820 https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe \u00a0of MedDream PACS Server or patch their current system using Fix-v230712 https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip .\n\n\u200bFor assistance or additional information about installing the software, please contact Softneta https://www.softneta.com/contacts/ \u00a0directly.\n\n\n\n\n"}], "source": {"advisory": "\u200b\u200bICSMA-23-248-01", "discovery": "EXTERNAL"}, "title": "Softneta MedDream PACS Exposed Dangerous Method or Function", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:24:55.602Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-26T14:31:00.611227Z", "id": "CVE-2023-40150", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T14:31:10.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:24:55.602Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-40150", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-26T14:31:00.611227Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T14:31:06.329Z"}}], "cna": {"title": "Softneta MedDream PACS Exposed Dangerous Method or Function", "source": {"advisory": "\u200b\u200bICSMA-23-248-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "\u200bNoam Moshe of Claroty Research reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Softneta", "product": "MedDream PACS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": " v7.2.8.810"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\n\u200bSoftneta recommends users update to v7.2.9.820 https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe \u00a0of MedDream PACS Server or patch their current system using Fix-v230712 https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip .\n\n\u200bFor assistance or additional information about installing the software, please contact Softneta https://www.softneta.com/contacts/ \u00a0directly.\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>\u200bSoftneta recommends users update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe\">v7.2.9.820</a> of MedDream PACS Server or patch their current system using <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip\">Fix-v230712</a>.</p><p>\u200bFor assistance or additional information about installing the software, please <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/contacts/\">contact Softneta</a> directly.</p>\n\n<br>", "base64": false}]}], "datePublic": "2023-09-05T17:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSoftneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749 Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-09-11T19:09:00.487Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40150", "state": "PUBLISHED", "dateUpdated": "2024-09-26T14:31:10.863Z", "dateReserved": "2023-08-18T16:28:34.426Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-09-11T19:05:00.754Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}