Santesoft discovered five vulnerabilities in the medical image archiving and communication system of its Sante PACS Server, which include a critical vulnerability that makes it possible for the interception of user credentials.
The vulnerabilities impact all Sante PACS Server versions before 4.2.3 and those that were patched in version 4.2.3 and newer versions. An attacker can exploit the three most critical vulnerabilities remotely in a low-complexity cyberattack. An attacker exploiting the vulnerabilities can create arbitrary files, get sensitive information, copy users’ session cookies, and trigger a denial-of-service issue.
- Critical vulnerability CVE-2025-54156 can be exploited remotely to steal credentials. It is caused by the Sante PACS Server delivering credential details in cleartext. The vulnerability has an assigned CVSS v3.1 score of 7.4 and a CVSS v4 score of 9.1.
- High-severity vulnerability CVE-2025-53948 can be exploited remotely to wreck the main thread by delivering a specially created HL7 message, causing a denial-of-service issue. The server needs a manual reboot. The vulnerability has an assigned CVSS v3.1 score of 7.5 and a CVSS v4 score of 8.7.
- Medium-severity vulnerability CVE-2025-0572 can be exploited remotely to create arbitrary DCM files on Sante PACS Servers that are vulnerable. The vulnerability is caused by the incorrect restriction of a pathname to a limited directory. The vulnerability CVSS v3.1 score is 4.3, and the CVSS v4 score is 5.3.
- Medium-severity vulnerability CVE-2025-54759 is a cross-site scripting vulnerability that can be exploited by adding malicious HTML code, redirecting a user to a malicious web page, stealing the user’s cookie. The vulnerability’s CVSS v3.1 is 6.1, and the CVSS v4 score is 5.1.
- Medium-severity vulnerability CVE-2025-54862 is a cross-site scripting vulnerability that impacts the Sante PACS Server website. An attacker can exploit the vulnerability to bring a user to a malicious HTML page and steal his/her cookie. The vulnerability’s assigned CVSS v3.1 is 5.4, and the CVSS v4 score is 4.8.
Chizuru Toyama of TXOne Networks identified the vulnerabilities and reported them to CISA. Currently, Santesoft has not received any reports of exploitation in the wild; nevertheless, users should upgrade their Santesoft Sante PACS Server to the most recent version immediately. HIPAA-covered entities using this product should take note of this information.
It is also advised to refrain from connecting the Santesoft Sante PACS Server online. When remote access is necessary, use a secure access, for instance, a Virtual Private Network (VPN), making sure it is updated and operating in the most recent version.
Image credit: pressmaster, AdobeStock
