CVE-2024-7872 Overview
CVE-2024-7872 is an information disclosure vulnerability affecting ExtremePACS Extreme XDS before build 3933. The flaw is categorized as Insertion of Sensitive Information Into Sent Data [CWE-201]. An attacker positioned on the adjacent network can retrieve embedded sensitive data transmitted by the application without requiring authentication or user interaction. Extreme XDS is a Picture Archiving and Communication System (PACS) used in medical imaging environments, which increases the sensitivity of the data at risk.
Critical Impact
An unauthenticated attacker on the adjacent network can retrieve sensitive data embedded in application traffic from Extreme XDS instances prior to build 3933.
Affected Products
- ExtremePACS Extreme XDS versions before build 3933
- Deployments exposing Extreme XDS services on shared or adjacent network segments
- Medical imaging environments running vulnerable Extreme XDS builds
Discovery Timeline
- 2025-03-06 - CVE-2024-7872 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7872
Vulnerability Analysis
The vulnerability stems from the application embedding sensitive information inside data that it transmits over the network. The Common Weakness Enumeration classifies this behavior as [CWE-201], where an application inserts sensitive values into messages sent to endpoints or intermediaries that should not receive them. Because Extreme XDS handles clinical imaging and associated metadata, exposed fields may include patient identifiers, study details, or system credentials transmitted alongside expected content.
An attacker on the adjacent network can passively observe or actively solicit these transmissions and extract the embedded values. No authentication is required, and the user interface is not involved in the exploitation path. Confidentiality impact is the primary concern, with limited secondary impact to integrity and availability.
Root Cause
The root cause is improper filtering or minimization of the data set placed into outbound messages. The application does not strip, redact, or separate sensitive fields before transmission, causing them to travel with routine traffic. Fixed builds starting at 3933 address the disclosure by constraining what is embedded in sent data.
Attack Vector
Exploitation requires adjacency to the target network, such as the same broadcast domain, VLAN, or wireless segment. From that position, an attacker captures traffic generated by Extreme XDS or induces the application to emit data containing the embedded sensitive values. The absence of authentication and user interaction requirements makes opportunistic collection feasible in shared hospital or clinic networks.
No public proof-of-concept exploit or exploitation-in-the-wild reporting is associated with CVE-2024-7872 at this time. See the Siber Güvenlik Advisory TR-25-0057 and the USOM Notification TR-25-0057 for coordinating advisory details.
Detection Methods for CVE-2024-7872
Indicators of Compromise
- Extreme XDS servers running builds earlier than 3933 on production networks
- Unencrypted or overly verbose PACS traffic containing patient or system identifiers on shared segments
- Unexpected packet captures, port mirrors, or sniffer devices attached to network segments carrying Extreme XDS traffic
Detection Strategies
- Inventory Extreme XDS installations and compare installed build numbers against the fixed build 3933
- Inspect DICOM and HTTP flows to and from Extreme XDS hosts for sensitive fields transmitted outside intended recipients
- Correlate promiscuous-mode network interfaces or ARP anomalies on VLANs hosting PACS systems with device inventory
Monitoring Recommendations
- Log and review all network sessions to Extreme XDS services, including source addresses outside the clinical imaging VLAN
- Alert on unauthorized packet capture tools running on hosts within PACS network segments
- Monitor for repeated or bulk retrieval patterns from adjacent hosts that could indicate data harvesting
How to Mitigate CVE-2024-7872
Immediate Actions Required
- Upgrade Extreme XDS to build 3933 or later on all systems
- Restrict access to the PACS network segment to authorized clinical devices and management hosts only
- Enforce encryption in transit for all Extreme XDS communications where supported
Patch Information
ExtremePACS addressed CVE-2024-7872 in Extreme XDS build 3933. Administrators should coordinate with ExtremePACS support to obtain the fixed build and validate the upgrade against clinical workflow requirements. Refer to the Siber Güvenlik Advisory TR-25-0057 for coordinated disclosure details.
Workarounds
- Isolate Extreme XDS instances on a dedicated VLAN with strict access control lists limiting adjacent-network exposure
- Disable or restrict wireless access to segments carrying PACS traffic until the upgrade is complete
- Deploy network segmentation and 802.1X authentication to reduce the population of hosts able to reach the adjacent network
# Example ACL restricting access to the Extreme XDS VLAN
# Replace 10.10.20.0/24 with the PACS subnet and 10.10.30.0/24 with the imaging modality subnet
access-list PACS_ACL permit tcp 10.10.30.0/24 10.10.20.0/24 eq 104
access-list PACS_ACL permit tcp 10.10.30.0/24 10.10.20.0/24 eq 443
access-list PACS_ACL deny ip any 10.10.20.0/24 log
access-list PACS_ACL permit ip any any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
