CISA flags critical flaws in dcm4che DICOM archive letting attackers delete and forge medical images

CISA's medical advisory covers six vulnerabilities in J4Care's dcm4chee-arc-light, a DICOM archive used in healthcare settings worldwide. The flaws range from missing authentication and authorization to denial-of-service conditions, with top CVSS v3 scores of 9.1. For anyone running medical imaging infrastructure, this is a patch-now item: the defaults ship insecure, and the vendor fix is already out.

• Six CVEs affect dcm4chee-arc-light 5.35.1; J4Care recommends upgrading to release 5.35.2 or later.
• In the default configuration, the archive and HL7 listener accept unauthenticated requests, enabling retrieval, forgery and patient-record reassignment.
• Top CVSS v3 base score is 9.1 (critical); CISA reports no known public exploitation to date.