CVE-2025-30398: Nuance PowerScribe Information Disclosure

CVE-2025-30398 Overview

CVE-2025-30398 is a missing authorization vulnerability in Microsoft Nuance PowerScribe One, a widely-used radiology reporting platform in healthcare environments. The vulnerability allows an unauthorized attacker to disclose sensitive information over a network without requiring authentication. This weakness stems from improper access control implementation (CWE-862), enabling attackers to bypass authorization checks and access protected resources.

Critical Impact

Unauthorized attackers can exploit this missing authorization flaw to access and disclose sensitive healthcare data over the network, potentially exposing patient information and compromising the confidentiality and integrity of radiology reporting systems.

Affected Products

• Microsoft Nuance PowerScribe One versions 4.0.1 through 4.0.9
• Microsoft Nuance PowerScribe One versions 2019.1 through 2019.10
• Microsoft Nuance PowerScribe One version 2023.1 SP2 Patch 7

Discovery Timeline

• 2025-11-11 - CVE-2025-30398 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-30398

Vulnerability Analysis

This vulnerability is classified as a Missing Authorization flaw (CWE-862), where the application fails to properly verify that a user is authorized to access a resource before granting access. In the context of Nuance PowerScribe One, this means that network-accessible endpoints or functionality do not adequately check whether the requesting party has the necessary permissions to view or manipulate data.

The attack can be executed remotely over the network and requires some user interaction to successfully exploit. When exploited, attackers can gain unauthorized access to sensitive information, potentially including patient data, radiology reports, and system configurations. The vulnerability also allows for unauthorized data modification, impacting both confidentiality and integrity of the affected systems.

Healthcare organizations using PowerScribe One for radiology reporting should consider this vulnerability particularly serious given the sensitive nature of medical data and HIPAA compliance requirements.

Root Cause

The root cause of CVE-2025-30398 is the absence of proper authorization checks within the Nuance PowerScribe One application. The software fails to validate whether users or requests have appropriate permissions before granting access to protected resources or functionality. This missing authorization mechanism allows unauthenticated or low-privileged users to access resources that should be restricted.

Attack Vector

The vulnerability is exploitable over the network, meaning an attacker does not need local access to the vulnerable system. The attack requires user interaction to complete, which may involve tricking a legitimate user into performing an action or visiting a malicious link. Once exploited, the attacker can access and potentially modify sensitive information without proper authorization.

The attack does not require any prior privileges on the target system, making it accessible to external threat actors who can reach the PowerScribe One application over the network.

Detection Methods for CVE-2025-30398

Indicators of Compromise

• Unusual access patterns to PowerScribe One endpoints from unauthorized IP addresses or user accounts
• Network traffic showing requests to protected resources without corresponding authentication events
• Log entries indicating access to sensitive data or functionality by unauthenticated sessions
• Unexpected data exports or information queries from the PowerScribe One application

Detection Strategies

• Monitor application logs for access attempts that lack proper authentication or authorization tokens
• Implement network-level monitoring for anomalous traffic patterns targeting PowerScribe One services
• Deploy web application firewalls (WAF) to detect and block unauthorized access attempts
• Review audit logs for data access events that do not correlate with legitimate user activity

Monitoring Recommendations

• Enable comprehensive logging for all PowerScribe One application access and authentication events
• Configure alerting for failed authorization checks or attempts to access restricted endpoints
• Implement SIEM correlation rules to identify patterns of unauthorized access attempts
• Regularly audit user access logs to identify anomalous behavior or unauthorized data access

How to Mitigate CVE-2025-30398

Immediate Actions Required

• Review the Microsoft Security Update for CVE-2025-30398 for available patches
• Restrict network access to PowerScribe One servers to authorized networks and users only
• Implement additional network segmentation to isolate healthcare applications
• Enable enhanced logging and monitoring for all PowerScribe One access events
• Conduct an audit of recent access logs to identify potential exploitation attempts

Patch Information

Microsoft has published a security update addressing this vulnerability. Organizations should consult the Microsoft Security Response Center advisory for specific patch versions and deployment guidance. Healthcare organizations should prioritize applying this update given the sensitive nature of data handled by PowerScribe One.

Workarounds

• Implement network-level access controls to restrict PowerScribe One access to trusted networks only
• Deploy a web application firewall (WAF) with rules to block unauthorized access patterns
• Enable multi-factor authentication for all PowerScribe One user accounts where supported
• Consider temporarily limiting external network access to PowerScribe One until patches can be applied

# Example network access restriction using firewall rules
# Restrict PowerScribe One access to internal healthcare network only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP