J4Care dcm4che
CISA warns J4Care dcm4chee-arc-light 5.35.1 flaws can delete images and expose patient data.
68
Vulnerability2 · 1 read
CVE-2026-105667
Unauthenticated HL7 patient-merge in J4Care dcm4che
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
In the default configuration, J4Care dcm4che's HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application (CWE-306). A remote sender can reassign imaging studies and related workflow records from one patient identity to another, and the archive's unmerge does not reverse that change. Impact is high integrity loss of patient and study linkage, with no confidentiality or availability impact scored (CVSS 4.0 8.7). Version ranges are not stated in the advisory data. It is not on CISA KEV, and no public proof-of-concept is known.
What to do: Keep the HL7 listener off untrusted networks and require authentication (or an equivalent allow-list of known sending applications) instead of the default unauthenticated configuration. Audit recent ADT^A40 merges for unexpected patient reassignment; do not rely on archive unmerge to undo them. Apply the J4Care fix when a patched release is identified for your deployment.
| Product | Affected |
|---|---|
| J4Care dcm4che | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
- Weakness
- CWE-306
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X