CVE-2025-0570
📋 TL;DR
This vulnerability allows authenticated remote attackers to cause denial-of-service conditions on Sante PACS Server installations by sending specially crafted DCM files. The memory corruption occurs during DCM file parsing due to insufficient input validation. Healthcare organizations using Sante PACS Server Web Portal are affected.
💻 Affected Systems
- Sante PACS Server Web Portal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring manual intervention to restore service, potentially disrupting medical imaging workflows and patient care.
Likely Case
Service disruption affecting the PACS web portal functionality, requiring system restart to recover normal operations.
If Mitigated
Minimal impact with proper authentication controls and input validation in place.
🎯 Exploit Status
Authentication required; attacker needs valid credentials and ability to upload DCM files to the portal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.santesoft.com/security-advisories/ (check for specific advisory)
Restart Required: Yes
Instructions:
1. Check vendor advisory for specific patch version
2. Download patch from Sante support portal
3. Apply patch following vendor instructions
4. Restart Sante PACS Server services
🔧 Temporary Workarounds
Restrict DCM file uploads
allLimit DCM file uploads to trusted sources only through network controls
Strengthen authentication
allImplement multi-factor authentication and strong password policies
🧯 If You Can't Patch
- Implement strict access controls to limit who can upload DCM files to the portal
- Deploy network segmentation to isolate PACS server from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Sante PACS Server version against vendor advisory; test with controlled DCM file upload if possibleCheck Version:
Check Sante PACS Server administration interface or configuration files for version informationVerify Fix Applied:
Verify patch installation via version check and test DCM file upload functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed DCM file upload attempts
- Service crash/restart events in application logs
- Unusual DCM file upload patterns
Network Indicators:
- Unusual DCM file upload traffic patterns
- Multiple authentication attempts followed by DCM uploads
SIEM Query:
source="sante-pacs" AND (event="service_crash" OR event="dcm_upload_error")