CVE-2024-1696
📋 TL;DR
This vulnerability allows local attackers to execute arbitrary code by exploiting an out-of-bounds write when a user opens a malicious DCM file in Santesoft Sante FFT Imaging. Affected users include healthcare organizations and medical imaging facilities using versions 1.4.1 and prior of this software.
💻 Affected Systems
- Santesoft Sante FFT Imaging
📦 What is this software?
Fft Imaging by Santesoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the affected system, potentially leading to data theft, ransomware deployment, or disruption of medical imaging operations.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive medical data and system resources.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious DCM files from being opened.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and local access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.4.2 or later (check vendor advisory)
Vendor Advisory: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-065-01
Restart Required: Yes
Instructions:
1. Download latest version from Santesoft vendor portal. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart system. 5. Verify functionality with test DCM files.
🔧 Temporary Workarounds
Restrict DCM file sources
allOnly allow DCM files from trusted sources and implement file validation
User awareness training
allTrain users to only open DCM files from verified medical sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized software execution
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file operations
🔍 How to Verify
Check if Vulnerable:
Check software version in Help > About menu. If version is 1.4.1 or earlier, system is vulnerable.Check Version:
Check via GUI: Help > About in Sante FFT Imaging applicationVerify Fix Applied:
Verify version is 1.4.2 or later and test opening known-good DCM files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Multiple failed DCM file parsing attempts
- Unusual process creation after DCM file access
- Memory access violations in application logs
Network Indicators:
- Unusual outbound connections from medical imaging workstations
- File transfers of DCM files from untrusted sources
SIEM Query:
source="windows-security" EventCode=4688 AND ProcessName="*FFT*" AND CommandLine="*.dcm"