CVE-2025-27724 is a critical privilege escalation vulnerability identified in MedDream PACS Premium version 7.3.3.840, a medical imaging software used for managing and viewing PACS (Picture Archiving and Communication System) data. The vulnerability stems from improper access control (CWE-284) in the login.php functionality. Specifically, the flaw allows an attacker to upload a specially crafted PHP file, which can then be executed to escalate privileges without requiring any authentication or user interaction. This vulnerability is particularly severe because it enables an unauthenticated attacker with local access (or potentially remote if upload functionality is exposed) to gain elevated capabilities, compromising confidentiality, integrity, and availability of the system. The CVSS v3.1 score of 9.3 (critical) reflects the high impact and ease of exploitation, with a scope change indicating that the vulnerability affects resources beyond the initially vulnerable component. The absence of known exploits in the wild suggests it is a recently disclosed vulnerability, but the critical nature demands immediate attention. Given the role of MedDream PACS in handling sensitive medical imaging data, exploitation could lead to unauthorized access to patient records, manipulation or deletion of medical images, and disruption of clinical workflows.

For European organizations, especially hospitals, clinics, and healthcare providers relying on MedDream PACS Premium, this vulnerability poses a significant risk. Exploitation could lead to unauthorized disclosure of sensitive patient health information, violating GDPR and other data protection regulations, potentially resulting in heavy fines and reputational damage. Integrity of medical images and diagnostic data could be compromised, leading to misdiagnosis or treatment errors. Availability impacts could disrupt critical healthcare services, delaying patient care. The healthcare sector in Europe is a frequent target for cyberattacks, and the criticality of this vulnerability increases the risk of targeted attacks. Additionally, the interconnected nature of healthcare IT systems means that compromise of PACS could serve as a pivot point for further lateral movement within hospital networks.

1. Immediate patching is recommended once MedDream releases an official update addressing CVE-2025-27724. Until then, restrict access to the PACS system, especially the upload functionality, to trusted personnel and networks only. 2. Implement strict file upload validation and filtering on the server side to block unauthorized or executable file types. 3. Employ network segmentation to isolate PACS servers from general user networks and limit exposure to potential attackers. 4. Monitor logs for unusual file uploads or execution attempts related to login.php or other web interfaces. 5. Use application-layer firewalls or web application firewalls (WAFs) to detect and block malicious payloads targeting the upload functionality. 6. Conduct regular security audits and penetration testing focused on access control mechanisms. 7. Educate staff on the risks of uploading files and enforce the principle of least privilege for user accounts interacting with PACS. 8. Consider deploying intrusion detection/prevention systems (IDS/IPS) tuned to detect exploitation attempts of this vulnerability.