Vulnerability · Published May 22, 2025 · Assigned by zdi

CVE-2025-3480MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability

Medium 5.3

In plain English

A medium-severity security flaw in WEB DICOM Viewer from MedDream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of MedDream WEB DICOM Viewer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Web Portal. The issue results from the lack of encryption when transmitting credentials. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-25842.

Affected products (as reported)

Vendor	Product	Versions
MedDream	WEB DICOM Viewer	bundled with MedDream PACS Premium 7.3.3.840

Weakness: CWE-522 · Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ZDI-25-246 x_research-advisory