J4Care - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/j4care/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 17:00:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMultiple Vulnerabilities in J4Care dcm4chee-arc-lighthttps://feed.craftedsignal.io/briefs/2026-10-j4care-dcm4chee/Thu, 15 Oct 2026 17:00:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-j4care-dcm4chee/Multiple critical vulnerabilities in J4Care dcm4chee-arc-light 5.35.1 enable remote, unauthenticated attackers to manipulate medical records, exfiltrate sensitive patient data, and induce denial-of-service conditions.J4Care dcm4chee-arc-light version 5.35.1 contains multiple critical vulnerabilities affecting the Healthcare and Public Health sector. These vulnerabilities, identified as CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, and CVE-2026-105667, allow remote, unauthenticated attackers to exploit flaws in REST services and DICOM protocol handlers. The impact of these vulnerabilities is significant, enabling unauthorized modification or deletion of medical images, disclosure of sensitive patient records, injection of forged studies, and disruption of critical imaging services. Organizations utilizing this archiving solution should prioritize upgrading to version 5.35.2 or later to mitigate these risks.

Attack Chain

  1. Attacker performs network reconnaissance to identify J4Care dcm4chee-arc-light instances accessible via DICOM or REST ports.
  2. Attacker initiates an unauthenticated DICOM association with the archive, leveraging the default configuration that accepts unregistered Application Entities (AEs).
  3. Attacker uses the C-FIND and C-GET protocol commands to enumerate patient identifiers and retrieve images.
  4. Attacker utilizes the C-STORE command to inject fabricated medical studies into the database under existing patient identities.
  5. Attacker leverages the storage status-change REST service to alter location records for targeted DICOM instances.
  6. PurgeStorageScheduler automatically deletes the referenced files from back-end storage based on the manipulated state.
  7. Attacker sends specially crafted JPEG or MP4 files to trigger infinite loops during parsing, resulting in service denial.

Impact

Successful exploitation risks the integrity and availability of medical imaging systems. Attackers can delete stored medical images, disclose confidential patient health information (PHI), corrupt patient record associations, and crash the archiving service. This poses immediate risks to patient care, operational continuity, and regulatory compliance within healthcare environments.

Recommendation

  • Patch affected systems by upgrading J4Care dcm4chee-arc-light to version 5.35.2 or later.
  • Implement strict access control lists on DICOM and REST service ports to prevent unauthorized associations from unregistered Application Entities.
  • Review logs for unusual C-FIND, C-GET, or C-STORE requests originating from unknown or unauthorized AE titles.
  • Restrict network exposure of the dcm4chee-arc-light management interface to trusted administrative subnets.
]]>mediumadvisoryhealthcaremedical-devicevulnerabilityremote-execution