CVE-2025-2284
Published: 13 March 2025
Summary
CVE-2025-2284 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the uninitialized pointer flaw in GetWebLoginCredentials by requiring timely application of patches or mitigations for the specific CVE.
Implements denial-of-service protections to block or limit exploitation attempts that crash the Sante PACS Server.exe via network-accessible unauthenticated requests.
Enforces memory protections such as ASLR and DEP to prevent successful exploitation of the CWE-824 uninitialized pointer dereference leading to DoS.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated DoS via exploitation of an uninitialized pointer in a server application, directly enabling T1499.004 (Application or System Exploitation) for endpoint denial of service.
NVD Description
A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe".
Deeper analysisAI
CVE-2025-2284 is a denial-of-service vulnerability in the "GetWebLoginCredentials" function within Sante PACS Server.exe. Published on 2025-03-13, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-824 (Access of Uninitialized Pointer).
The vulnerability can be exploited by an unauthenticated attacker over the network with low attack complexity and no user interaction required. Successful exploitation leads to a high-impact denial of service, disrupting availability of the affected service without affecting confidentiality or integrity.
Mitigation details are available in the Tenable advisory at https://www.tenable.com/security/research/tra-2025-08.
Details
- CWE(s)