PatchSiren cyber security CVE debrief

CVE-2024-28877 MicroDicom CVE debrief

CVE-2024-28877 is a stack-based buffer overflow vulnerability in MicroDicom DICOM Viewer versions prior to 2024.2. The vulnerability was published by CISA on June 11, 2024, with a CVSS 3.1 score of 8.8 (HIGH). Successful exploitation requires user interaction, such as opening a malicious DICOM file, and may allow an attacker to execute arbitrary code on affected installations. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. MicroDicom has released version 2024.2 to address this issue.

Vendor: MicroDicom
Product: DICOM Viewer
CVSS: HIGH 8.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-06-11
Original CVE updated: 2024-06-11
Advisory published: 2024-06-11
Advisory updated: 2024-06-11

Who should care

Healthcare organizations, medical imaging departments, radiology practices, and any entities using MicroDicom DICOM Viewer for medical image processing should prioritize patching. Security teams in healthcare environments should assess exposure and implement compensating controls where patching is delayed.

Technical summary

A stack-based buffer overflow vulnerability exists in MicroDicom DICOM Viewer versions prior to 2024.2. The vulnerability can be triggered when a user opens a specially crafted DICOM file, potentially leading to arbitrary code execution. The attack vector is network-accessible with low attack complexity, requires no privileges, but does require user interaction. The vulnerability has high impact on confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

Upgrade MicroDicom DICOM Viewer to version 2024.2 or later
Implement application whitelisting to prevent execution of unauthorized DICOM Viewer versions
Train users to avoid opening DICOM files from untrusted sources
Consider network segmentation for systems running DICOM Viewer software
Monitor for suspicious DICOM file handling activity

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSMA-24-163-01. Affected product confirmed as MicroDicom DICOM Viewer versions prior to 2024.2. Vendor fix identified as upgrade to version 2024.2.

Sources and references

Verified primary and authoritative sources

CVE-2024-28877 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-28877

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-28877 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-28877

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsma-24-163-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.