CVE-2023-40150
Published: 11 September 2023
Summary
CVE-2023-40150 is a critical-severity Exposed Dangerous Method or Function (CWE-749) vulnerability in Softneta Meddream Pacs. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Softneta MedDream PACS is affected by CVE-2023-40150, a vulnerability in which the application fails to perform authentication checks before allowing dangerous functionality. This exposure enables unauthenticated remote code execution and carries a CVSS 3.1 base score of 9.8 reflecting network-accessible attack vectors with no required credentials or user interaction.
An unauthenticated remote attacker can directly invoke the unprotected functionality to execute arbitrary code on the affected PACS server, potentially compromising confidentiality, integrity, and availability of medical imaging systems.
CISA has published ICS Medical Advisory ICSMA-23-248-01 detailing the issue and associated guidance for healthcare environments.
The EPSS score for this CVE rose materially from a low baseline to a peak of 0.2671 on 2025-01-22 before receding to the current value of 0.0085, indicating that exploitation interest emerged after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44757
Vulnerability details
Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.