Cyber Posture

CVE-2025-2284

High

Published: 13 March 2025

Published
13 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0680 91.4th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2284 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the uninitialized pointer flaw in GetWebLoginCredentials by requiring timely application of patches or mitigations for the specific CVE.

preventdetect

Implements denial-of-service protections to block or limit exploitation attempts that crash the Sante PACS Server.exe via network-accessible unauthenticated requests.

prevent

Enforces memory protections such as ASLR and DEP to prevent successful exploitation of the CWE-824 uninitialized pointer dereference leading to DoS.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The CVE describes a remote unauthenticated DoS via exploitation of an uninitialized pointer in a server application, directly enabling T1499.004 (Application or System Exploitation) for endpoint denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe".

Deeper analysisAI

CVE-2025-2284 is a denial-of-service vulnerability in the "GetWebLoginCredentials" function within Sante PACS Server.exe. Published on 2025-03-13, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-824 (Access of Uninitialized Pointer).

The vulnerability can be exploited by an unauthenticated attacker over the network with low attack complexity and no user interaction required. Successful exploitation leads to a high-impact denial of service, disrupting availability of the affected service without affecting confidentiality or integrity.

Mitigation details are available in the Tenable advisory at https://www.tenable.com/security/research/tra-2025-08.

Details

CWE(s)

CVEs Like This One

CVE-2026-2100Shared CWE-824
CVE-2026-28691Shared CWE-824
CVE-2026-6778Shared CWE-824
CVE-2025-32451Shared CWE-824
CVE-2024-57943Shared CWE-824
CVE-2026-6757Shared CWE-824
CVE-2026-21275Shared CWE-824
CVE-2026-21276Shared CWE-824
CVE-2025-66588Shared CWE-824
CVE-2025-26599Shared CWE-824

References