CVE-2025-24485: Meddream PACS Server SSRF Vulnerability

CVE-2025-24485 Overview

CVE-2025-24485 is a Server-Side Request Forgery (SSRF) vulnerability in the cecho.php functionality of MedDream PACS Premium version 7.3.5.860. An unauthenticated attacker can send a specially crafted HTTP request to coerce the server into making arbitrary outbound requests on the attacker's behalf. The flaw is tracked under CWE-918 and affects medical imaging deployments where the Picture Archiving and Communication System (PACS) server is reachable over the network.

Critical Impact
Unauthenticated attackers can abuse the PACS server to probe internal networks, reach otherwise restricted services, and exfiltrate confidentiality-sensitive responses without credentials.

Affected Products

MedDream PACS Premium 7.3.5.860
MedDream PACS Server (Premium edition)
Deployments exposing cecho.php over HTTP

Discovery Timeline

2025-07-28 - CVE-2025-24485 published to NVD with Talos advisory TALOS-2025-2177
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-24485

Vulnerability Analysis

The vulnerability resides in the cecho.php endpoint shipped with MedDream PACS Premium 7.3.5.860. The endpoint accepts HTTP parameters that influence the destination of a server-initiated network connection. Because input validation on the destination is insufficient, an attacker can substitute attacker-chosen hosts or internal addresses.

DICOM C-ECHO operations are intended to verify connectivity between PACS nodes. When the web-facing wrapper accepts user-controlled targets without authentication, it converts a benign diagnostic into a network pivot primitive. The result is loss of confidentiality of internal service responses and broader internal reconnaissance.

The issue is exploitable without authentication and without user interaction, requiring only network reachability to the PACS web interface.

Root Cause

The root cause is missing validation and authorization on user-controlled destination parameters processed by cecho.php. The endpoint trusts client-supplied host and port values when initiating server-side connections, which classifies the flaw as a textbook SSRF (CWE-918).

Attack Vector

An attacker sends a single crafted HTTP request to the cecho.php endpoint with parameters pointing at an internal IP address, loopback service, or external collaborator host. The PACS server then initiates the connection from its own network position. Attackers can enumerate internal hosts, identify open ports, reach metadata services in cloud deployments, and retrieve response data depending on how the server handles the returned bytes.

No exploitation code has been published. See the Talos Intelligence Vulnerability Report for the reproduction details disclosed by the researchers.

// No verified public proof-of-concept is available for CVE-2025-24485.
// Refer to TALOS-2025-2177 for technical reproduction details.

Detection Methods for CVE-2025-24485

Indicators of Compromise

HTTP requests to cecho.php originating from unexpected source IPs or external networks
Outbound connections from the PACS host targeting internal RFC1918 ranges, 127.0.0.1, or cloud metadata addresses such as 169.254.169.254
Unusual spikes in short-lived TCP connections initiated by the PACS service process

Detection Strategies

Inspect web server access logs for unauthenticated requests to cecho.php containing host or address parameters
Correlate inbound HTTP requests to cecho.php with outbound connections from the PACS server within a short time window
Alert on PACS server connections to non-DICOM peers, cloud metadata endpoints, or loopback ports

Monitoring Recommendations

Capture and retain full HTTP request URIs and parameters for the PACS web interface
Forward PACS host network flow data to centralized logging for outbound connection baselining
Monitor process-level network activity on the PACS server to identify deviations from normal DICOM peer behavior

How to Mitigate CVE-2025-24485

Immediate Actions Required

Restrict network access to the MedDream PACS web interface to trusted clinical networks only
Block unauthenticated access to cecho.php at the reverse proxy or web application firewall layer
Apply egress filtering on the PACS server to deny outbound connections to RFC1918, loopback, and cloud metadata addresses
Contact MedDream for an updated build addressing TALOS-2025-2177

Patch Information

No vendor patch URL is published in the NVD record at the time of writing. Administrators should consult MedDream directly and reference TALOS-2025-2177 for the latest remediation guidance. Upgrade beyond MedDream PACS Premium 7.3.5.860 once a fixed version is available.

Workarounds

Place the PACS web interface behind an authenticated reverse proxy that enforces client certificate or SSO checks
Deny requests to cecho.php from non-administrative source ranges using web server access control rules
Implement strict egress allowlists so the PACS host can only reach known DICOM peers

bash

# Example nginx snippet restricting cecho.php to an administrative subnet
location = /cecho.php {
    allow 10.10.20.0/24;
    deny all;
    proxy_pass http://meddream_backend;
}