MicroDicom DICOM Viewer Improper Certificate Validation Vulnerability Allowing Machine-in-the-Middle Attacks

A vulnerability exists in MicroDicom DICOM Viewer version 2024.03 due to improper validation of the update server's certificate. This flaw could enable attackers in a privileged network position to intercept and alter network traffic, executing a machine-in-the-middle (MITM) attack. Such an attack would allow the modification of the server's response to the user, potentially delivering a malicious update.

Impact

Exploitation of this vulnerability could lead to a machine-in-the-middle (MITM) attack, allowing attackers to intercept, alter, and inject malicious updates into the user's DICOM viewer.

Remediation

Users are advised to upgrade to MicroDicom DICOM Viewer version 2025.1. For additional guidance, refer to the CISA ICS Medical Advisory.