Summary
The DICOM archive accepts associations from calling application entities that have not been registered or authenticated in its default configuration. A remote peer may use DICOM query, retrieval, and storage services to access patient information and medical images or place fabricated study content under an existing patient identity.
The DICOM archive accepts associations from calling application entities that have not been registered or authenticated in its default configuration. A remote peer may use DICOM query, retrieval, and storage services to access patient information and medical images or place fabricated study content under an existing patient identity.
Affected context
This vulnerability occurs in DICOM archive deployments that retain a default configuration allowing associations from unregistered calling AEs. The risk is highest when the archive is reachable by untrusted or insufficiently restricted networks and when C-FIND, C-GET, or C-STORE services are available without effective peer authentication or authorization.
This vulnerability occurs in DICOM archive deployments that retain a default configuration allowing associations from unregistered calling AEs. The risk is highest when the archive is reachable by untrusted or insufficiently restricted networks and when C-FIND, C-GET, or C-STORE services are available without effective peer authentication or authorization.
Exploit preconditions
- Attack surface: Network-accessible DICOM services
- Required access: Network connectivity to the archive; valid DICOM association parameters may be sufficient
- Trigger point: Association establishment followed by C-FIND, C-GET, or C-STORE requests
- Why exploitation is possible: The default configuration does not require the calling AE to be registered or otherwise authenticated before sensitive query, retrieval, and storage operations are permitted
- Attack surface: Network-accessible DICOM services
- Required access: Network connectivity to the archive; valid DICOM association parameters may be sufficient
- Trigger point: Association establishment followed by C-FIND, C-GET, or C-STORE requests
- Why exploitation is possible: The default configuration does not require the calling AE to be registered or otherwise authenticated before sensitive query, retrieval, and storage operations are permitted
Why this happens
The underlying issue is an authentication control gap in the DICOM association workflow. The archive trusts a remote calling AE before establishing that the peer is an authorized system or user, allowing protected operations to proceed based only on network-level protocol interaction. This maps to CWE-306: Missing Authentication for Critical Function, because sensitive data access and content-modification functions are exposed without an effective authentication requirement.
The underlying issue is an authentication control gap in the DICOM association workflow. The archive trusts a remote calling AE before establishing that the peer is an authorized system or user, allowing protected operations to proceed based only on network-level protocol interaction. This maps to CWE-306: Missing Authentication for Critical Function, because sensitive data access and content-modification functions are exposed without an effective authentication requirement.
Potential impact
- Unauthorized enumeration of patient records and study metadata
- Disclosure of medical images and other protected health information
- Fabrication or alteration of study content associated with an existing patient identity
- Loss of confidence in the integrity and provenance of archived records
- Regulatory, privacy, clinical, and operational consequences
- Unauthorized enumeration of patient records and study metadata
- Disclosure of medical images and other protected health information
- Fabrication or alteration of study content associated with an existing patient identity
- Loss of confidence in the integrity and provenance of archived records
- Regulatory, privacy, clinical, and operational consequences
General mitigation guidance
Mitigation generally focuses on requiring strong peer authentication and authorization before allowing DICOM operations.
Common defensive patterns include:
- Rejecting associations from unknown or unregistered calling AEs by default
- Using mutually authenticated transport or equivalent authenticated channels where supported
- Enforcing per-AE authorization for query, retrieval, and storage operations
- Separating read and write privileges and granting only the minimum required capability
- Restricting DICOM endpoints with network segmentation, allowlists, and policy enforcement
- Validating stored objects and maintaining provenance, audit trails, and review controls
- Disabling unnecessary services and requiring secure configuration baselines
Mitigation generally focuses on requiring strong peer authentication and authorization before allowing DICOM operations.
Common defensive patterns include:
- Rejecting associations from unknown or unregistered calling AEs by default
- Using mutually authenticated transport or equivalent authenticated channels where supported
- Enforcing per-AE authorization for query, retrieval, and storage operations
- Separating read and write privileges and granting only the minimum required capability
- Restricting DICOM endpoints with network segmentation, allowlists, and policy enforcement
- Validating stored objects and maintaining provenance, audit trails, and review controls
- Disabling unnecessary services and requiring secure configuration baselines
How teams detect issues like this
Organizations can detect this class of issue through:
- Configuration reviews that identify acceptance of unknown or unregistered calling AEs
- Static and policy analysis for default-allow association settings or disabled authentication controls
- Code and architecture reviews of DICOM association negotiation and authorization paths
- Network monitoring for unexpected C-FIND, C-GET, and C-STORE activity
- Audit-log analysis for anonymous, unknown, or unusual calling AEs and abnormal retrieval volumes
- Security tests that verify unauthorized peers cannot query, retrieve, or store objects
- Automated configuration scanners and compliance rules that enforce authenticated, least-privilege DICOM access
Organizations can detect this class of issue through:
- Configuration reviews that identify acceptance of unknown or unregistered calling AEs
- Static and policy analysis for default-allow association settings or disabled authentication controls
- Code and architecture reviews of DICOM association negotiation and authorization paths
- Network monitoring for unexpected C-FIND, C-GET, and C-STORE activity
- Audit-log analysis for anonymous, unknown, or unusual calling AEs and abnormal retrieval volumes
- Security tests that verify unauthorized peers cannot query, retrieve, or store objects
- Automated configuration scanners and compliance rules that enforce authenticated, least-privilege DICOM access
