CVE-2025-24485: Meddream PACS Server SSRF Vulnerability

CVE-2025-24485 Overview

CVE-2025-24485 is a Server-Side Request Forgery (SSRF) vulnerability in the cecho.php functionality of MedDream PACS Premium version 7.3.5.860. An unauthenticated attacker can send a specially crafted HTTP request to coerce the server into making arbitrary outbound requests on the attacker's behalf. The flaw is tracked under CWE-918 and affects medical imaging deployments where the Picture Archiving and Communication System (PACS) server is reachable over the network.

Critical Impact

Unauthenticated attackers can abuse the PACS server to probe internal networks, reach otherwise restricted services, and exfiltrate confidentiality-sensitive responses without credentials.

Affected Products

• MedDream PACS Premium 7.3.5.860
• MedDream PACS Server (Premium edition)
• Deployments exposing cecho.php over HTTP

Discovery Timeline

• 2025-07-28 - CVE-2025-24485 published to NVD with Talos advisory TALOS-2025-2177
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-24485

Vulnerability Analysis

The vulnerability resides in the cecho.php endpoint shipped with MedDream PACS Premium 7.3.5.860. The endpoint accepts HTTP parameters that influence the destination of a server-initiated network connection. Because input validation on the destination is insufficient, an attacker can substitute attacker-chosen hosts or internal addresses.

DICOM C-ECHO operations are intended to verify connectivity between PACS nodes. When the web-facing wrapper accepts user-controlled targets without authentication, it converts a benign diagnostic into a network pivot primitive. The result is loss of confidentiality of internal service responses and broader internal reconnaissance.

The issue is exploitable without authentication and without user interaction, requiring only network reachability to the PACS web interface.

Root Cause

The root cause is missing validation and authorization on user-controlled destination parameters processed by cecho.php. The endpoint trusts client-supplied host and port values when initiating server-side connections, which classifies the flaw as a textbook SSRF (CWE-918).

Attack Vector

An attacker sends a single crafted HTTP request to the cecho.php endpoint with parameters pointing at an internal IP address, loopback service, or external collaborator host. The PACS server then initiates the connection from its own network position. Attackers can enumerate internal hosts, identify open ports, reach metadata services in cloud deployments, and retrieve response data depending on how the server handles the returned bytes.

No exploitation code has been published. See the Talos Intelligence Vulnerability Report for the reproduction details disclosed by the researchers.

// No verified public proof-of-concept is available for CVE-2025-24485.
// Refer to TALOS-2025-2177 for technical reproduction details.

Detection Methods for CVE-2025-24485

Indicators of Compromise

• HTTP requests to cecho.php originating from unexpected source IPs or external networks
• Outbound connections from the PACS host targeting internal RFC1918 ranges, 127.0.0.1, or cloud metadata addresses such as 169.254.169.254
• Unusual spikes in short-lived TCP connections initiated by the PACS service process

Detection Strategies

• Inspect web server access logs for unauthenticated requests to cecho.php containing host or address parameters
• Correlate inbound HTTP requests to cecho.php with outbound connections from the PACS server within a short time window
• Alert on PACS server connections to non-DICOM peers, cloud metadata endpoints, or loopback ports

Monitoring Recommendations

• Capture and retain full HTTP request URIs and parameters for the PACS web interface
• Forward PACS host network flow data to centralized logging for outbound connection baselining
• Monitor process-level network activity on the PACS server to identify deviations from normal DICOM peer behavior

How to Mitigate CVE-2025-24485

Immediate Actions Required

• Restrict network access to the MedDream PACS web interface to trusted clinical networks only
• Block unauthenticated access to cecho.php at the reverse proxy or web application firewall layer
• Apply egress filtering on the PACS server to deny outbound connections to RFC1918, loopback, and cloud metadata addresses
• Contact MedDream for an updated build addressing TALOS-2025-2177

Patch Information

No vendor patch URL is published in the NVD record at the time of writing. Administrators should consult MedDream directly and reference TALOS-2025-2177 for the latest remediation guidance. Upgrade beyond MedDream PACS Premium 7.3.5.860 once a fixed version is available.

Workarounds

• Place the PACS web interface behind an authenticated reverse proxy that enforces client certificate or SSO checks
• Deny requests to cecho.php from non-administrative source ranges using web server access control rules
• Implement strict egress allowlists so the PACS host can only reach known DICOM peers

# Example nginx snippet restricting cecho.php to an administrative subnet
location = /cecho.php {
    allow 10.10.20.0/24;
    deny all;
    proxy_pass http://meddream_backend;
}