CVE-2024-23914 | Nozomi Networks Labs

Summary

A "CWE-134 Use of Externally-Controlled Format String" vulnerability affects the MC_Open_Association function located in Merative Merge DICOM Toolkit C/C++ on Windows

Impact

When MC_Open_Association function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception. The vulnerability can be exploited by unauthenticated attackers with a privileged position in the network.

Issue Date

April 30, 2024

Affects

This issue affects: Merative Merge DICOM Toolkit C/C++ on Windows from v5.6.0 up to v.5.17.0

CVE Name

CVE-2024-23914

CVSS Details

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS Score

5.7

Solution

Update the Merative Merge DICOM Toolkit C/C++ to the 5.18.0 release

Mitigations

Acknowledgements

Gabriele Quagliarella of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more