The vulnerability allows any remote peer to establish a DICOM association with the archive without authentication. Once connected, an attacker can enumerate patient information and retrieve medical images via C‑FIND and C‑GET, and can also inject fabricated study content under an existing patient identity using C‑STORE. This results in a severe compromise of data confidentiality and integrity, as protected medical information can be accessed and altered by an unauthenticated adversary.

The affected product is J4Care dcm4chee‑arc‑light. Vulnerable versions are those that have not yet been updated to release 5.35.2 or later; the official fix is provided in release 5.35.2 onwards.

The CVSS score of 9.3 classifies this flaw as critical. No EPSS score is available, so the precise exploitation likelihood is unknown, but the flaw can be exercised remotely over the DICOM network protocol. Because the flaw is a missing authentication (CWE‑306), an attacker does not need prior credentials. The vulnerability is not listed in the CISA KEV catalog, but its impact and severity warrant immediate attention.