Cyber Resilience

CVE-2023-40150

Critical

Published: 11 September 2023

Published
11 September 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0085 75.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-40150 is a critical-severity Exposed Dangerous Method or Function (CWE-749) vulnerability in Softneta Meddream Pacs. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Softneta MedDream PACS is affected by CVE-2023-40150, a vulnerability in which the application fails to perform authentication checks before allowing dangerous functionality. This exposure enables unauthenticated remote code execution and carries a CVSS 3.1 base score of 9.8 reflecting network-accessible attack vectors with no required credentials or user interaction.

An unauthenticated remote attacker can directly invoke the unprotected functionality to execute arbitrary code on the affected PACS server, potentially compromising confidentiality, integrity, and availability of medical imaging systems.

CISA has published ICS Medical Advisory ICSMA-23-248-01 detailing the issue and associated guidance for healthcare environments.

The EPSS score for this CVE rose materially from a low baseline to a peak of 0.2671 on 2025-01-22 before receding to the current value of 0.0085, indicating that exploitation interest emerged after public disclosure.

EU & UK References

Vulnerability details

Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

softneta
meddream pacs
≤ 7.2.8.810

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-749

Explicitly prohibiting dangerous or unnecessary functions and services prevents exposure of methods that could be directly exploited.

addresses: CWE-749

Minimal functionality removes or avoids exposure of dangerous methods and functions.

References