Executive Summary
In February 2025, a vulnerability (CVE-2025-1001) was identified in Medixant's RadiAnt DICOM Viewer, a widely used medical imaging application. The flaw stemmed from improper certificate validation in the software's update mechanism, allowing attackers to perform machine-in-the-middle (MITM) attacks. By intercepting and modifying network traffic, malicious actors could deliver harmful updates to users, potentially compromising medical imaging systems. Medixant promptly addressed the issue by releasing version 2025.1, which rectified the vulnerability. Users were advised to update to this version or later to mitigate the risk. (cisa.gov)
This incident underscores the critical importance of robust certificate validation in software update mechanisms, especially within the healthcare sector. As cyber threats targeting medical infrastructure continue to evolve, ensuring the integrity and security of software updates remains paramount to protect sensitive patient data and maintain operational continuity.
Why This Matters Now
The CVE-2025-1001 vulnerability in Medixant's RadiAnt DICOM Viewer highlights the ongoing risks associated with improper certificate validation in software update mechanisms. As cyber threats targeting healthcare systems persist, ensuring the integrity of software updates is crucial to protect sensitive patient data and maintain operational continuity.
Attack Path Analysis
An attacker exploits the RadiAnt DICOM Viewer's failure to verify update server certificates, performing a man-in-the-middle attack to deliver a malicious update. Upon execution, the malicious update grants the attacker elevated privileges within the system. The attacker then moves laterally to access other systems within the network. A command and control channel is established to maintain persistent access and control over the compromised systems. Sensitive medical imaging data is exfiltrated from the network. The attack culminates in the disruption of medical imaging services, impacting patient care.
Kill Chain Progression
Initial Compromise
Description
An attacker exploits the RadiAnt DICOM Viewer's failure to verify update server certificates, performing a man-in-the-middle attack to deliver a malicious update.
Related CVEs
CVE-2026-17264
CVSS 4.3An out-of-bounds write vulnerability in Medixant RadiAnt DICOM Viewer versions up to 2025.2 allows an attacker to cause the application to crash by opening a maliciously crafted DICOM file.
Affected Products:
Medixant RadiAnt DICOM Viewer – <=2025.2
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploitation for Client Execution
User Execution: Malicious File
Endpoint Denial of Service
Endpoint Denial of Service: Application or System Exploitation
Hardware Additions
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 – Flaw Remediation
Control ID: SI-2
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Data Security
Control ID: Pillar 3: Data
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
DICOM vulnerability exploitation in RadiAnt software threatens medical imaging systems, enabling heap corruption attacks that compromise patient data integrity and healthcare operations.
Medical Equipment
Out-of-bounds write vulnerability in medical imaging software allows remote code execution through malicious DICOM files, disrupting critical diagnostic equipment and patient care.
Computer Software/Engineering
JPEG-compressed pixel data exploitation demonstrates software security risks requiring enhanced input validation, secure coding practices, and comprehensive vulnerability management across development lifecycles.
Information Technology/IT
Network segmentation and egress filtering capabilities become critical for preventing malicious DICOM file distribution and containing lateral movement in healthcare IT infrastructures.
Sources
- Medixant RadiAnt DICOMhttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-218-01Verified
- NVD - CVE-2026-17264https://nvd.nist.gov/vuln/detail/CVE-2026-17264Verified
- RadiAnt DICOM Viewer Security Considerationshttps://www.radiantviewer.com/dicom-viewer-manual/security-considerations.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally, establish command and control channels, and exfiltrate sensitive data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to deliver malicious updates may be constrained by enforcing strict identity-based policies and continuous verification of workload communications.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to leverage elevated privileges may be limited by enforcing strict segmentation policies that restrict access to sensitive resources.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement may be restricted by continuous monitoring and control of east-west traffic, reducing the risk of further system compromise.
Control: Multicloud Visibility & Control
Mitigation: The establishment of command and control channels may be hindered by comprehensive visibility and control over multicloud environments, detecting and disrupting unauthorized communications.
Control: Egress Security & Policy Enforcement
Mitigation: The exfiltration of sensitive data may be prevented by enforcing strict egress policies that monitor and control outbound data flows.
The disruption of medical imaging services may be mitigated by limiting the attacker's ability to compromise multiple systems, thereby reducing the overall impact on patient care.
Impact at a Glance
Affected Business Functions
- Medical Imaging Review
- Patient Diagnosis
Estimated downtime: 1 days
Estimated loss: $5,000
Potential exposure of patient medical images and associated metadata.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Encrypted Traffic (HPE) to secure data in transit and prevent man-in-the-middle attacks.
- • Deploy Zero Trust Segmentation to enforce least privilege access and limit lateral movement within the network.
- • Utilize East-West Traffic Security to monitor and control internal traffic, detecting unauthorized access attempts.
- • Establish Multicloud Visibility & Control to gain comprehensive insights into network activities and identify anomalies.
- • Enforce Egress Security & Policy Enforcement to control outbound traffic and prevent unauthorized data exfiltration.
