CVE-2024-25386
Published: 01 March 2024
Summary
CVE-2024-25386 is a high-severity Path Traversal (CWE-22) vulnerability in Laurelbridge (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-25386 is a directory traversal vulnerability, tracked under CWE-22, that affects the DICOM Connectivity Framework by Laurelbridge in versions prior to 2.7.6b. The flaw resides in the format_logfile.pl file and carries a CVSS 3.1 score of 8.8, reflecting network-accessible attack vectors with low complexity and no required user interaction.
A remote attacker with low privileges can exploit the issue over the network to traverse directories and execute arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected system.
Vendor advisories and technical references, including Laurelbridge's security notice and public proof-of-concept disclosures, indicate that the vulnerability is addressed by upgrading to version 2.7.6b or later. The associated EPSS score has remained near 0.1 with only minor fluctuation between its current value of 0.0950 and peak of 0.1031.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-22719
Vulnerability details
Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.