Multiple RCE vulnerabilities in Sante PACS Server 4.1.0
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four vulnerabilities in Sante PACS Server 4.1.0 enable unauthenticated remote code execution; no active exploitation reported.
MS-ISAC has published an advisory on multiple vulnerabilities affecting Sante PACS Server version 4.1.0. The most critical issue is a stack-based buffer overflow (CVE-2025-2263) in the login handler where OpenSSL's EVP_DecryptUpdate function is called with a fixed 0x80-byte stack buffer. An unauthenticated attacker can supply an oversized encrypted username or password to trigger the overflow and achieve remote code execution in the system context. A second critical flaw (CVE-2025-2264) is a path-traversal vulnerability allowing unauthenticated remote download of arbitrary files from the system disk.
Two additional lower-severity vulnerabilities are documented: CVE-2025-2265, a password storage flaw where truncation of SHA1 hashes containing zero bytes weakens credential protection in the SQLite HTTP.db database, and CVE-2025-2284, a denial-of-service condition in the GetWebLoginCredentials function. The advisory reports no current in-the-wild exploitation. Successful exploitation of the critical flaws grants an attacker the ability to install programs, view, modify, or delete data depending on system privileges. The vendor Santesoft has released patches, and immediate deployment after testing is strongly recommended for all systems running the affected version.
Mentioned in this report
Detection guidance
Sante PACS Server Process Spawning Shell or LOLBin
A Sante PACS Server process spawning a command interpreter or common LOLBin, a likely sign of post-exploitation after the login-handler stack overflow (CVE-2025-2263). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sante PACS Server Process Spawning Shell or LOLBin
description: Detects a Sante PACS Server process spawning a command interpreter or
common living-off-the-land binary. A DICOM/PACS web service has no normal reason
to start these, so it suggests code execution after exploitation of the unauthenticated
login-handler stack overflow (CVE-2025-2263). The parent match is on the product
name rather than a fixed install path.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-2263
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: Sante
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
- \whoami.exe
- \net.exe
- \net1.exe
condition: selection
falsepositives:
- Administrators running vendor-supplied maintenance or backup scripts launched by
the PACS service
- Vendor installer or updater launched from a Sante-named parent process
level: high
id: 0ce09537-31f9-5c7d-8629-149d710536f6
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026
Path Traversal Request Targeting System Files on Web Server
Web requests with directory traversal sequences that reference sensitive system files or the PACS HTTP.db database, consistent with CVE-2025-2264 arbitrary file download. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Request Targeting System Files on Web Server
description: Detects HTTP requests that contain directory traversal sequences together
with references to sensitive Windows system files or the Sante PACS SQLite HTTP.db
credential database. Matches the unauthenticated arbitrary file download behaviour
of CVE-2024-2264 style path traversal flaws such as CVE-2025-2264. Review the response
status and size to confirm whether the file was returned.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-2264
logsource:
category: webserver
detection:
selection_traversal:
- cs-uri-stem|contains:
- ../
- ..\
- '%2e%2e'
- ..%5c
- ..%2f
- cs-uri-query|contains:
- ../
- ..\
- '%2e%2e'
- ..%5c
- ..%2f
selection_target:
- cs-uri-stem|contains:
- win.ini
- boot.ini
- windows/system32
- windows\system32
- HTTP.db
- /etc/passwd
- cs-uri-query|contains:
- win.ini
- boot.ini
- windows/system32
- windows\system32
- HTTP.db
- /etc/passwd
condition: selection_traversal and selection_target
falsepositives:
- Authorised vulnerability scanners probing for path traversal
- Penetration tests against the PACS web interface
level: high
id: 34cf7c8e-0276-5317-8d21-cbef6bc20bd6
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026
Sante PACS Server Process Writing Executable or Script Files
A Sante PACS Server process creating executable or script files on disk, which may indicate payload staging after RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sante PACS Server Process Writing Executable or Script Files
description: Detects a Sante PACS Server process creating executable, DLL or script
files. After exploiting the unauthenticated login overflow (CVE-2025-2263) an attacker
running in the service context may drop payloads. The server normally writes only
images, database and log files.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-2263
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains: Sante
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .bat
- .cmd
- .vbs
- .js
- .hta
condition: selection
falsepositives:
- Vendor software updates or patch installation performed by the PACS service
- Plugin or codec DLLs being installed by an administrator
level: high
id: 3e26e311-b51d-59ab-9af6-d639436791ec
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026
Behavioural rules are generated from public reporting — validate in your environment before deploying.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs