PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-1696 Santesoft CVE debrief

CVE-2024-1696 is a high-severity vulnerability in Santesoft Sante FFT Imaging, a medical imaging software used for processing DICOM (DCM) files. Published on March 5, 2024, this vulnerability affects versions 1.4.1 and prior. The flaw stems from an out-of-bounds write condition that triggers when a user opens a maliciously crafted DCM file. A local attacker can exploit this to achieve arbitrary code execution with the privileges of the user running the application. The CVSS 3.1 score of 7.8 reflects high impacts to confidentiality, integrity, and availability, with a local attack vector requiring user interaction. The vulnerability is particularly concerning in healthcare environments where DICOM files are routinely exchanged and processed. Santesoft has released version 1.4.2 to address this issue. CISA has issued advisory ICSMA-24-065-01 providing additional mitigation guidance.

Vendor
Santesoft
Product
Sante FFT Imaging
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-03-05
Original CVE updated
2024-03-05
Advisory published
2024-03-05
Advisory updated
2024-03-05

Who should care

Healthcare organizations, medical imaging departments, radiology practices, and any entities using Sante FFT Imaging for DICOM file processing should prioritize this vulnerability. System administrators managing medical workstations and security teams responsible for protecting patient data and clinical systems are particularly affected.

Technical summary

The vulnerability exists in the DCM file parsing functionality of Sante FFT Imaging versions ≤1.4.1. Insufficient bounds checking during file processing enables an out-of-bounds write memory corruption condition. Exploitation requires a local attacker to convince a user to open a crafted DCM file, after which code execution occurs in the user's security context. The attack complexity is low, and no privileges are required, though user interaction is necessary. The vulnerability does not cross security boundaries (unchanged scope).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Sante FFT Imaging to version 1.4.2 or later immediately.
  • Implement application whitelisting to prevent execution of unauthorized software.
  • Train users to avoid opening DCM files from untrusted sources.
  • Apply principle of least privilege to limit impact of potential exploitation.
  • Consider network segmentation for systems processing medical imaging data.

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSMA-24-065-01. Vendor fix confirmed via Santesoft download page referenced in remediation data. CVSS vector and score derived from official CISA source.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-1696 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-1696

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-1696 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-1696

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsma-24-065-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-065-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.