CVE-2025-1001: RadiAnt DICOM Viewer MITM Vulnerability

CVE-2025-1001 Overview

Medixant RadiAnt DICOM Viewer contains a critical certificate validation vulnerability in its update mechanism. The software fails to properly verify the update server's certificate, allowing attackers on an adjacent network to perform machine-in-the-middle (MITM) attacks. By intercepting and modifying network traffic between the application and update servers, an attacker could deliver malicious updates to unsuspecting users, potentially compromising medical imaging workstations.

Critical Impact

Attackers can intercept software updates and deliver malicious payloads to healthcare systems running RadiAnt DICOM Viewer, potentially compromising patient data and medical imaging infrastructure.

Affected Products

• Medixant RadiAnt DICOM Viewer (versions prior to 2025.1)

Discovery Timeline

• 2025-02-21 - CVE CVE-2025-1001 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2025-1001

Vulnerability Analysis

This vulnerability is classified as CWE-295 (Improper Certificate Validation), representing a fundamental flaw in the software's secure update implementation. RadiAnt DICOM Viewer's update mechanism does not properly validate the SSL/TLS certificate presented by the update server during the software update process.

When the application checks for or downloads updates, it fails to verify that the certificate chain is valid, trusted, and belongs to the legitimate update server. This implementation oversight creates a window for man-in-the-middle attacks where an adversary positioned on the same network segment can intercept the update communication.

The attack requires the adversary to be on an adjacent network (such as a local hospital network or shared WiFi), and some user interaction is required for successful exploitation. While the vulnerability does not directly expose confidential data, it provides a high-impact vector for integrity compromise—allowing attackers to replace legitimate updates with trojanized versions.

Root Cause

The root cause is improper implementation of TLS certificate validation in the software's update client. The application either skips certificate verification entirely, accepts self-signed certificates, or fails to properly validate the certificate chain against trusted root CAs. This is a common oversight in medical software where developers may disable certificate checks during development and fail to re-enable them in production builds.

Attack Vector

The attack requires the adversary to position themselves on the same network segment as the target system running RadiAnt DICOM Viewer. Using techniques such as ARP spoofing or DNS hijacking, the attacker can redirect update requests to a malicious server. When the victim's application attempts to download an update, the attacker intercepts the connection and presents their own certificate. Due to the missing validation, the application accepts this fraudulent certificate and downloads the attacker-controlled payload.

The attack flow involves: network positioning on an adjacent network, traffic interception of update requests, certificate spoofing to impersonate the update server, and payload delivery of malicious software disguised as a legitimate update. Once the malicious update is installed, the attacker gains code execution on the target system with the privileges of the RadiAnt application.

Detection Methods for CVE-2025-1001

Indicators of Compromise

• Unexpected network connections from RadiAnt DICOM Viewer to unknown IP addresses during update checks
• Certificate warnings or SSL/TLS errors in system logs related to the update process
• Modified or unsigned RadiAnt executable files after update operations
• Unusual outbound network traffic from medical imaging workstations

Detection Strategies

• Monitor network traffic for connections from RadiAnt DICOM Viewer to non-standard update servers
• Implement network-based certificate pinning validation for known medical software update channels
• Deploy endpoint detection rules to identify unsigned or tampered RadiAnt binaries
• Use network intrusion detection systems to identify potential ARP spoofing or DNS hijacking on healthcare network segments

Monitoring Recommendations

• Enable comprehensive logging on medical imaging workstations running RadiAnt DICOM Viewer
• Monitor for certificate-related errors in application and system logs
• Implement file integrity monitoring for RadiAnt installation directories
• Track software version changes and correlate with authorized update windows

How to Mitigate CVE-2025-1001

Immediate Actions Required

• Update RadiAnt DICOM Viewer to version 2025.1 or later immediately
• Isolate medical imaging workstations on segmented network VLANs to reduce adjacent network attack surface
• Implement network access controls to prevent unauthorized devices from joining healthcare network segments
• Disable automatic updates and manually verify update packages until patched version is deployed

Patch Information

Medixant has released RadiAnt DICOM Viewer version 2025.1 which addresses this vulnerability. The update is available from the official RadiAnt website. Organizations should verify the authenticity of downloaded updates by checking file signatures before deployment. For additional details, refer to the CISA Medical Advisory ICSMA-25-051-01.

Workarounds

• Download updates manually from the official RadiAnt website over a trusted network connection and verify file integrity before installation
• Implement network segmentation to isolate DICOM workstations from potentially compromised network segments
• Use a VPN or other encrypted tunnel when performing software updates on untrusted networks
• Deploy network monitoring to detect and alert on potential MITM attacks targeting medical imaging systems

# Network isolation example for medical imaging workstations
# Configure firewall rules to restrict update traffic to verified endpoints
iptables -A OUTPUT -p tcp --dport 443 -d radiantviewer.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j LOG --log-prefix "RADIANT_UPDATE_BLOCKED: "