CVE-2025-11671: SoliPACS WebServer Info Disclosure Flaw

CVE-2025-11671 Overview

CVE-2025-11671 is a missing authentication vulnerability in the Uniweb/SoliPACS WebServer developed by EBM Technologies. Unauthenticated remote attackers can access a specific page to obtain sensitive information, including account names and IP addresses. The flaw is classified under [CWE-306] Missing Authentication for Critical Function. The vulnerability is exploitable over the network without user interaction or prior credentials, making reconnaissance against affected deployments straightforward.

Critical Impact
Remote unauthenticated attackers can harvest account names and internal IP addresses from exposed Uniweb/SoliPACS WebServer instances, enabling follow-on credential attacks and network reconnaissance.

Affected Products

EBM Technologies Uniweb WebServer
EBM Technologies SoliPACS WebServer
Deployments exposed to untrusted networks without network-layer access controls

Discovery Timeline

2025-10-13 - CVE-2025-11671 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11671

Vulnerability Analysis

The Uniweb/SoliPACS WebServer exposes a specific page that performs a sensitive information disclosure function without enforcing authentication. Any remote client that can reach the web server over the network can request the endpoint and receive account names and IP address data in the response.

This is a classic instance of [CWE-306] Missing Authentication for Critical Function. The application logic assumes the endpoint is only reachable by trusted internal callers, but no session token, credential check, or authorization gate is enforced at the request-handling layer. The vulnerability affects Picture Archiving and Communication System (PACS) infrastructure, which is commonly deployed in healthcare environments to manage medical imaging data.

Root Cause

The root cause is the absence of authentication middleware or access control checks on a page that returns identity and network metadata. Endpoints returning administrative or user-scoped data must validate the caller's session before serving a response. In this product, the endpoint is directly reachable and returns data unconditionally.

Attack Vector

An attacker who can reach the web server over HTTP or HTTPS issues a request to the vulnerable page. No credentials, cookies, or tokens are required. The server responds with account names and IP addresses. Attackers can automate this against internet-exposed instances discovered through search engines that index network services. The disclosed data supports credential-guessing attacks, targeted phishing, and lateral-movement planning against internal networks.

No verified public proof-of-concept code is available. See the TW-CERT Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2025-11671

Indicators of Compromise

Unauthenticated HTTP GET requests to Uniweb/SoliPACS WebServer pages that return JSON or HTML containing user account fields
Anomalous source IP addresses issuing repeated requests to a narrow set of PACS web server endpoints
Outbound reconnaissance traffic from hosts that recently received scraped account or IP data

Detection Strategies

Inspect web server access logs for requests to sensitive information endpoints originating from unauthenticated sessions
Deploy web application firewall (WAF) rules that flag or block requests to the vulnerable page from external networks
Correlate account enumeration attempts with subsequent authentication failures on the same or related identity systems

Monitoring Recommendations

Baseline expected client IP ranges for the PACS web server and alert on requests outside that range
Monitor for HTTP responses containing account name patterns leaving the server perimeter
Track failed and successful logins on downstream systems for accounts recently enumerated via the vulnerable endpoint

How to Mitigate CVE-2025-11671

Immediate Actions Required

Restrict network access to the Uniweb/SoliPACS WebServer using firewall rules or VPN-only access until a patched version is applied
Contact EBM Technologies to confirm the fixed release and upgrade path for your deployment
Review web server logs for prior unauthenticated access to the affected page and treat exposed account names as compromised identifiers

Patch Information

Refer to the TW-CERT Security Advisory and the TW-CERT Security Report for vendor guidance and patch availability. Apply the vendor-supplied update as soon as it is available for your version.

Workarounds

Place the web server behind an authenticating reverse proxy that enforces access control before requests reach the application
Block external access to the vulnerable page path at the network or WAF layer
Segment the PACS environment from general-purpose networks and restrict management interfaces to trusted administrative subnets

bash

# Example nginx reverse proxy access restriction
location / {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://solipacs-backend;
}