Orthanc Server Fehlende Authentifizierung für kritische Funktion

The primary impact of CVE-2025-0896 is unauthorized access to the Orthanc server. Because Orthanc is frequently used in medical imaging environments, this could lead to the exposure of Protected Health Information (PHI) and other sensitive patient data. An attacker could potentially download entire datasets of medical images, modify existing images, or even inject malicious images into the system. The lack of authentication means that no credentials are required to access the server, significantly lowering the barrier to entry for attackers. This vulnerability presents a high risk of data breach and potential regulatory penalties.

Healthcare organizations utilizing Orthanc server for medical image storage and retrieval are at significant risk. This includes hospitals, clinics, radiology centers, and research institutions. Organizations with legacy Orthanc deployments or those that have not implemented proper security configurations are particularly vulnerable.

• windows / supply-chain: Monitor network traffic for unauthorized access attempts to the Orthanc server on the default port. Use Windows Defender to scan for suspicious processes or files associated with Orthanc. • linux / server: Use journalctl -u orthanc to monitor Orthanc logs for unusual activity. Implement auditd rules to track access attempts to the Orthanc server. • generic web: Use curl -I <orthancserverip> to check if remote access is enabled without authentication. Examine access logs for unauthorized access attempts.

1. 2025-02-13Disclosure

   disclosure

1. Reserviert2025-01-30
2. Veröffentlicht2025-02-13
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-0896 is to upgrade Orthanc server to version 1.5.8 or later. If upgrading is not immediately possible, consider temporarily disabling remote access functionality. As a secondary measure, implement a Web Application Firewall (WAF) with rules to block unauthorized access attempts to the Orthanc server. Ensure that any existing firewall rules are reviewed and updated to restrict access to only authorized IP addresses. After upgrading, confirm the fix by attempting to access the Orthanc server remotely without providing credentials; access should be denied.