CVE-2025-10350: CGM NETRAAD SQL Injection Vulnerability

CVE-2025-10350 Overview

A SQL Injection vulnerability exists in the "imageserver" module of CGM NETRAAD software when processing C-FIND queries. An attacker connected to the Picture Archiving and Communication System (PACS) can exploit this flaw to gain unauthorized access to the database, including sensitive data processed by CGM CLININET software. This vulnerability affects healthcare imaging infrastructure, potentially exposing patient medical records and diagnostic imaging data.

Critical Impact
Attackers with adjacent network access can exploit SQL Injection in PACS connectivity to access healthcare databases containing protected patient information, including data from integrated CGM CLININET systems.

Affected Products

CGM NETRAAD with imageserver module in versions before 7.9.0
CGM CLININET (data exposure via database access)
PACS-connected healthcare imaging systems

Discovery Timeline

2026-03-02 - CVE CVE-2025-10350 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2025-10350

Vulnerability Analysis

This vulnerability is classified as CWE-89: SQL Injection, a critical web application security flaw that allows attackers to manipulate database queries through malicious input. The vulnerability resides in the imageserver module's handling of C-FIND queries, which are part of the DICOM (Digital Imaging and Communications in Medicine) standard used in medical imaging systems.

When the imageserver module processes C-FIND requests from PACS clients, it fails to properly sanitize input parameters before incorporating them into SQL queries. This allows an authenticated attacker with low privileges on the adjacent network to inject arbitrary SQL commands, bypassing normal access controls and directly interacting with the underlying database.

The attack surface is particularly concerning in healthcare environments where PACS systems are typically deployed within hospital networks. Successful exploitation grants access not only to data within CGM NETRAAD but also to information processed by integrated CGM CLININET clinical information systems, significantly expanding the potential impact of a breach.

Root Cause

The root cause is improper input validation in the imageserver module's C-FIND query handler. User-supplied parameters in DICOM C-FIND requests are concatenated directly into SQL queries without proper sanitization, parameterization, or prepared statement usage. This allows specially crafted query parameters to escape the intended SQL context and execute arbitrary database commands.

Attack Vector

The attack vector requires adjacent network access (AV:A), meaning the attacker must be connected to the same network segment as the PACS infrastructure. This typically requires either physical access to the hospital network, compromised credentials for VPN access, or exploitation of another vulnerability to gain network foothold. Once positioned on the network, the attacker can send malicious C-FIND queries through the DICOM protocol to the imageserver module, injecting SQL payloads that extract, modify, or delete database contents.

The attack involves crafting DICOM C-FIND messages with SQL injection payloads embedded in query parameters such as patient name, study date, or accession number fields. When processed by the vulnerable imageserver module, these payloads execute against the database with the privileges of the application's database user account.

Detection Methods for CVE-2025-10350

Indicators of Compromise

Unusual DICOM C-FIND queries containing SQL syntax characters such as single quotes, semicolons, or SQL keywords (UNION, SELECT, INSERT, DROP)
Database error messages or exceptions logged by the imageserver module
Unexpected database queries or query patterns in database audit logs
Anomalous data access patterns to patient records or clinical data

Detection Strategies

Deploy network intrusion detection systems (IDS) with signatures for SQL injection patterns in DICOM traffic
Enable detailed logging on the imageserver module and monitor for malformed C-FIND requests
Implement database activity monitoring to detect unauthorized queries or data exfiltration
Configure SIEM rules to correlate PACS access logs with database query anomalies

Monitoring Recommendations

Monitor all DICOM association requests and C-FIND operations for suspicious parameter values
Enable database query logging and review for injection patterns or unauthorized data access
Track authentication failures and unusual access patterns on PACS network segments
Implement alerting for any database errors originating from the imageserver application

How to Mitigate CVE-2025-10350

Immediate Actions Required

Upgrade CGM NETRAAD imageserver module to version 7.9.0 or later immediately
Implement network segmentation to restrict access to PACS infrastructure from untrusted network segments
Review and restrict database user privileges used by the imageserver module to minimum required permissions
Enable comprehensive logging and monitoring on affected systems while patching is in progress

Patch Information

The vendor has addressed this vulnerability in CGM NETRAAD imageserver module version 7.9.0. Organizations should update to this version or later to remediate the SQL injection vulnerability. Refer to the CERT Security Analysis for CVE-2025-10350 for additional details. Product information is available at the CGM Product Overview for Netraad.

Workarounds

Deploy a web application firewall (WAF) or database firewall with SQL injection detection rules in front of the imageserver module
Implement strict network access controls limiting which systems can communicate with the PACS imageserver
Consider temporarily disabling or restricting C-FIND functionality if not operationally critical while awaiting patch deployment
Apply principle of least privilege to database accounts used by the imageserver, removing unnecessary write or administrative permissions

Organizations should prioritize patching given the healthcare data exposure risk and the potential for regulatory compliance violations under HIPAA and similar healthcare data protection regulations.