{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dcm4chee-arc-light-5.35.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dcm4chee-arc-light (5.35.1)"],"_cs_severities":["medium"],"_cs_tags":["healthcare","medical-device","vulnerability","remote-execution"],"_cs_type":"advisory","_cs_vendors":["J4Care"],"content_html":"\u003cp\u003eJ4Care dcm4chee-arc-light version 5.35.1 contains multiple critical vulnerabilities affecting the Healthcare and Public Health sector. These vulnerabilities, identified as CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, and CVE-2026-105667, allow remote, unauthenticated attackers to exploit flaws in REST services and DICOM protocol handlers. The impact of these vulnerabilities is significant, enabling unauthorized modification or deletion of medical images, disclosure of sensitive patient records, injection of forged studies, and disruption of critical imaging services. Organizations utilizing this archiving solution should prioritize upgrading to version 5.35.2 or later to mitigate these risks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify J4Care dcm4chee-arc-light instances accessible via DICOM or REST ports.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an unauthenticated DICOM association with the archive, leveraging the default configuration that accepts unregistered Application Entities (AEs).\u003c/li\u003e\n\u003cli\u003eAttacker uses the C-FIND and C-GET protocol commands to enumerate patient identifiers and retrieve images.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes the C-STORE command to inject fabricated medical studies into the database under existing patient identities.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the storage status-change REST service to alter location records for targeted DICOM instances.\u003c/li\u003e\n\u003cli\u003ePurgeStorageScheduler automatically deletes the referenced files from back-end storage based on the manipulated state.\u003c/li\u003e\n\u003cli\u003eAttacker sends specially crafted JPEG or MP4 files to trigger infinite loops during parsing, resulting in service denial.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation risks the integrity and availability of medical imaging systems. Attackers can delete stored medical images, disclose confidential patient health information (PHI), corrupt patient record associations, and crash the archiving service. This poses immediate risks to patient care, operational continuity, and regulatory compliance within healthcare environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected systems by upgrading J4Care dcm4chee-arc-light to version 5.35.2 or later.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists on DICOM and REST service ports to prevent unauthorized associations from unregistered Application Entities.\u003c/li\u003e\n\u003cli\u003eReview logs for unusual C-FIND, C-GET, or C-STORE requests originating from unknown or unauthorized AE titles.\u003c/li\u003e\n\u003cli\u003eRestrict network exposure of the dcm4chee-arc-light management interface to trusted administrative subnets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T17:00:22Z","date_published":"2026-10-15T17:00:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-j4care-dcm4chee/","summary":"Multiple critical vulnerabilities in J4Care dcm4chee-arc-light 5.35.1 enable remote, unauthenticated attackers to manipulate medical records, exfiltrate sensitive patient data, and induce denial-of-service conditions.","title":"Multiple Vulnerabilities in J4Care dcm4chee-arc-light","url":"https://feed.craftedsignal.io/briefs/2026-10-j4care-dcm4chee/"}],"language":"en","title":"CraftedSignal Threat Feed - Dcm4chee-Arc-Light (5.35.1)","version":"https://jsonfeed.org/version/1.1"}