Summary
Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information, modify records, or cause a denial-of-service condition.
Vulnerabilities 1
-
Critical 9.8
Orthanc Server Missing Authentication for Critical Function
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.
Revision history
-
#1
Initial Publication
References
-
ICSA Advisory ICSMA-25-037-02 - Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B