CybersecurityVulnerability Management

CVE-2025-0896: Orthanc Server Critical Vulnerability Overview

Analyst 207|
CVE-2025-0896: Orthanc Server Critical Vulnerability Overview

Summary of Orthanc Server Vulnerability

This document outlines a critical vulnerability in the Orthanc Server, specifically related to missing authentication for critical functions. The vulnerability could allow unauthorized access, leading to potential data disclosure, modification, or denial-of-service conditions.

1. EXECUTIVE SUMMARY

  • CVSS v4 Score: 9.2
  • Exploitation: Remotely exploitable with low attack complexity
  • Vendor: Orthanc
  • Equipment: Orthanc Server
  • Vulnerability: Missing Authentication for Critical Function

2. RISK EVALUATION

Exploitation of this vulnerability could allow attackers to access sensitive information, modify records, or disrupt services.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

  • Orthanc server: Versions prior to 1.5.8

3.2 VULNERABILITY OVERVIEW

3.2.1 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306

The Orthanc server versions before 1.5.8 do not enable basic authentication by default when remote access is enabled, leading to unauthorized access risks.

This vulnerability is identified as CVE-2025-0896, with a CVSS v3.1 base score of 9.8 and a CVSS v4 score of 9.2.

3.3 BACKGROUND

  • Critical Infrastructure Sectors: Healthcare and Public Health
  • Deployment Areas: Worldwide
  • Company Headquarters: Belgium

3.4 RESEARCHER

The vulnerability was reported by Amitay Dan to Orthanc and by Souvik Kandar to CISA.

4. MITIGATIONS

Orthanc recommends updating to the latest version or enabling HTTP authentication in the configuration file.

CISA suggests additional defensive measures, including:

  • Minimizing network exposure for control systems.
  • Using firewalls to isolate control system networks.
  • Utilizing secure remote access methods like VPNs.

Organizations should conduct impact analysis and risk assessments before implementing defensive measures.

5. UPDATE HISTORY

  • February 6, 2025: Initial Publication

For more details, visit the original article at CSAF GitHub.

Critical InfrastructureHealthcareVulnerability
Related Intelligence

Continue Reading

Concerned computer user looks at screen amidst paperwork and files.

7-Zip Patches RCE Flaw in XZ-Compressed Data Handling

Don't risk your files! 7-Zip's latest update, version 26.02, patches a critical vulnerability that could let hackers take control when you open a malicious archive.

Analyst 207
Smartphone on a neutral surface with blank screen and hint of a hand nearby.

Biometric Age Verification Shifts to On-Device Processing

With data breaches skyrocketing - a record 3,322 in the US last year alone - and over 30 age assurance laws now in force worldwide, the need for robust biometric age verification has never been more pressing. As governments crack down on underage access to social media, on-device processing is emerging as a crucial solution.

Analyst 207
Laptop on a minimalist desk with a potted plant and stack of paper in soft natural light.

WordPress Discloses Core Flaw Enabling Unauthenticated Code Execution

WordPress has patched a critical flaw that allowed hackers to execute code remotely without authentication, releasing versions 6.9.5 and 7.0.2 to fix the vulnerability. The update addresses a REST API batch-route confusion and SQL injection issue that could be triggered by a simple HTTP request.

Analyst 207
Rows of computer servers and networking equipment in a dimly lit data center with one server highlighted.

OpenSSL Flaw Exposes Servers to Memory Exhaustion Attacks

A newly discovered OpenSSL flaw, dubbed HollowByte, leaves unpatched servers vulnerable to memory exhaustion attacks, where a mere 11 bytes can trigger the allocation of up to 131 KB of memory for a message that never arrives. This tiny trigger can bring a server to its knees, freezing memory and blocking critical connections.

Analyst 207