CISA issued a medical advisory covering multiple vulnerabilities in J4Care’s dcm4chee-arc-light 5.35.1, a widely deployed DICOM archive server used in healthcare environments worldwide. The flaws carry a CVSS score up to 9.1 and span missing authorization, missing authentication for critical functions, infinite loops, and inefficient algorithmic complexity. Exploitation could let an attacker delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, or trigger denial-of-service conditions.
From an identity and access perspective, the most notable issues are the missing authentication and missing authorization weaknesses. These allow unauthorized actors to invoke sensitive REST functions — for example, the storage status-change service can mark location records for deletion, causing stored objects to be purged while database records linger, leading to data integrity and availability failures.
What to take away: Even specialized medical infrastructure depends on sound access controls. Organizations running dcm4che should restrict network exposure, enforce authentication on critical endpoints, and apply vendor fixes, treating missing-auth flaws as high-priority given the potential for silent patient-data tampering.