CVE-2025-11672 Overview
CVE-2025-11672 affects the Uniweb/SoliPACS WebServer developed by EBM Technologies. The product contains a missing authentication flaw [CWE-306] on a specific page that exposes user group names. Unauthenticated remote attackers can query this page over the network and retrieve group name information without providing credentials.
Taiwan CERT published advisories tracking this issue. The vulnerability enables reconnaissance against affected deployments by revealing internal user group structures. This information supports follow-on attacks such as targeted credential attacks or privilege mapping.
Critical Impact
Unauthenticated remote attackers can access a specific page on the Uniweb/SoliPACS WebServer to obtain user group names, enabling reconnaissance for subsequent attacks.
Affected Products
- EBM Technologies Uniweb WebServer
- EBM Technologies SoliPACS WebServer
- Specific affected versions are documented in the Taiwan CERT advisories
Discovery Timeline
- 2025-10-13 - CVE-2025-11672 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11672
Vulnerability Analysis
The Uniweb/SoliPACS WebServer exposes a page that returns user group names without enforcing authentication. This weakness maps to [CWE-306] Missing Authentication for Critical Function. The server accepts requests to the vulnerable endpoint from any network client and responds with sensitive group data.
SoliPACS is a Picture Archiving and Communication System (PACS) used in healthcare environments to store and distribute medical imaging data. Exposure of user group names in this context reveals organizational structure and role assignments within clinical systems.
The issue is scoped to information disclosure. The CVSS vector indicates limited confidentiality impact with no direct effect on integrity or availability. Attackers gain visibility into user grouping data, which can accelerate reconnaissance for targeted credential attacks or lateral movement planning.
Root Cause
The root cause is the absence of authentication checks on a specific application page. The endpoint responsible for returning user group data does not validate session tokens, credentials, or authorization headers before responding. Any client that reaches the WebServer over the network receives the group name data.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable page on an exposed Uniweb or SoliPACS WebServer instance. The server responds with user group names, which the attacker collects for later use in credential or access-based attacks.
The vulnerability manifests when the WebServer processes requests to the affected page without first invoking its authentication layer. Consult the Taiwan CERT Advisory #10420 and Taiwan CERT Advisory #10419 for vendor-supplied technical details.
Detection Methods for CVE-2025-11672
Indicators of Compromise
- Unauthenticated HTTP GET requests to Uniweb/SoliPACS WebServer pages returning JSON or HTML containing group name fields
- Access log entries showing successful HTTP 200 responses to the affected page from unauthenticated sessions
- Requests to the WebServer originating from unexpected external IP addresses or non-clinical network segments
Detection Strategies
- Inspect WebServer access logs for requests to the specific vulnerable page identified in the Taiwan CERT advisories
- Alert on repeated requests to Uniweb/SoliPACS endpoints from clients that never complete an authentication handshake
- Correlate reconnaissance-style access patterns against PACS assets with subsequent authentication attempts targeting the disclosed group names
Monitoring Recommendations
- Enable verbose HTTP access logging on all Uniweb/SoliPACS WebServer instances and forward logs to a central SIEM
- Monitor perimeter traffic to healthcare imaging systems and flag unauthenticated queries against PACS management pages
- Track outbound reconnaissance patterns from compromised endpoints toward internal PACS infrastructure
How to Mitigate CVE-2025-11672
Immediate Actions Required
- Apply the vendor-supplied patch referenced in the Taiwan CERT Advisory #10420 as soon as it is available in your environment
- Restrict network access to Uniweb/SoliPACS WebServer instances so only authorized clinical workstations can reach the management interface
- Audit WebServer access logs for prior unauthenticated requests to the affected page and document any exposure
Patch Information
EBM Technologies coordinated disclosure through Taiwan CERT. Refer to the Taiwan CERT Advisory #10420 and Taiwan CERT Advisory #10419 for the vendor-specified fixed versions and update instructions. Deploy the fixed release across all Uniweb and SoliPACS WebServer hosts.
Workarounds
- Place Uniweb/SoliPACS WebServer behind a reverse proxy that enforces authentication before requests reach the application
- Use network segmentation and firewall rules to block untrusted networks from reaching the WebServer TCP ports
- Deploy a web application firewall rule that blocks unauthenticated access to the specific page identified in the vendor advisories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
