CVE-2025-1002: Microdicom DICOM Viewer MITM Attack Vulnerability

CVE-2025-1002 is an information disclosure flaw in Microdicom DICOM Viewer that fails to verify update server certificates, enabling attackers to perform MITM attacks and deliver malicious updates. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-1002 Overview

CVE-2025-1002 affects MicroDicom DICOM Viewer version 2024.03. The application fails to adequately verify the update server's certificate during the update process. An attacker in a privileged network position can intercept and modify update traffic, delivering a malicious update to the user. The flaw is categorized as Improper Certificate Validation [CWE-295].

MicroDicom DICOM Viewer is used by healthcare professionals to view medical imaging data. Successful exploitation leads to code delivery through a trusted update channel, impacting integrity on the affected workstation.

Critical Impact
Attackers on an adjacent network can perform a machine-in-the-middle (MITM) attack against the update mechanism and deliver a malicious update payload to healthcare endpoints running the vulnerable viewer.

Affected Products

MicroDicom DICOM Viewer version 2024.03
Windows workstations running the affected viewer build
Healthcare imaging environments deploying the vendor update client

Discovery Timeline

2025-02-10 - CVE-2025-1002 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1002

Vulnerability Analysis

The MicroDicom DICOM Viewer update client contacts the vendor's update server over a network channel but does not properly validate the server's TLS certificate. Because the client accepts certificates that would otherwise fail standard chain-of-trust checks, an attacker positioned between the client and the legitimate update endpoint can present a substitute certificate. The client proceeds with the update transaction as if the connection were authentic.

Once the connection is established, the attacker controls the response body. The update client parses attacker-supplied metadata and downloads an attacker-controlled binary that the application treats as a legitimate update. The result is trusted execution of arbitrary code on a clinical workstation.

Exploitation requires user interaction. A user must initiate or accept an update, and the attacker must occupy an adjacent network position such as a shared LAN, hospital Wi-Fi, or a compromised network device on the path to the update host.

Root Cause

The root cause is improper certificate validation [CWE-295] in the update client. The client fails to enforce hostname verification, chain-of-trust validation, or both, when negotiating the TLS session to the update server. Without these checks, TLS provides encryption but not authentication of the remote endpoint.

Attack Vector

An attacker on the same broadcast domain, or with control over an upstream network device, performs ARP spoofing, DNS spoofing, or BGP or route hijacking to redirect update traffic. The attacker terminates the TLS session with a self-signed or unrelated certificate. The vulnerable client accepts the certificate and downloads the attacker-supplied update artifact. The artifact executes with the privileges of the user running the viewer.

See the CISA Medical Advisory ICSMA-25-037-01 for vendor-coordinated technical details.

Detection Methods for CVE-2025-1002

Indicators of Compromise

Unexpected outbound TLS connections from MicroDicom processes to hosts other than the official update domain.
Update binaries written to the MicroDicom installation directory that are not signed by the vendor's code-signing certificate.
ARP table anomalies or DNS responses on clinical subnets pointing update hostnames to non-vendor IP addresses.

Detection Strategies

Inspect TLS handshakes from the viewer process and alert on certificates that do not chain to the vendor's expected issuer.
Monitor for new child processes spawned by the MicroDicom updater and correlate with recent network activity.
Baseline the network destinations contacted by MicroDicom hosts and alert on deviations.

Monitoring Recommendations

Enable TLS inspection on egress paths from clinical workstations where policy permits.
Collect process, network, and file-write telemetry from endpoints running the DICOM viewer and forward to a centralized data lake for correlation.
Alert on execution of unsigned or newly observed binaries from the MicroDicom install path.

How to Mitigate CVE-2025-1002

Immediate Actions Required

Restrict use of MicroDicom DICOM Viewer 2024.03 until a fixed version is applied.
Block the update client from contacting the internet directly and require egress through an inspected proxy.
Segment clinical imaging workstations from general-purpose and guest networks to reduce adjacent-network exposure.

Patch Information

Refer to the vendor and CISA Medical Advisory ICSMA-25-037-01 for the fixed version and update instructions. Apply the vendor-provided update through a trusted, out-of-band channel rather than the in-product updater until the certificate validation fix is confirmed installed.

Workarounds

Disable the in-product automatic update feature and distribute vendor-signed installers through managed software deployment.
Enforce 802.1X and DHCP snooping on clinical VLANs to limit ARP and rogue-DHCP based interception.
Pin DNS resolution for the vendor update domain to trusted internal resolvers with DNSSEC validation where available.

bash

# Configuration example: block viewer update traffic at the host firewall
# and force updates through an inspected management channel (Windows)
netsh advfirewall firewall add rule name="Block MicroDicom Updater" ^
  dir=out program="C:\Program Files\MicroDicom\DICOM Viewer\updater.exe" ^
  action=block enable=yes