CVE-2025-26469 is a Critical flaw (CVSS 9.3) in MedDream PACS Premium 7.3.3.840, a medical imaging server. Incorrect default permissions let a specially crafted application decrypt credentials stored in a configuration related registry key. The record names no fixed version, so check the Talos report and the vendor.
What's affected
- Product: MedDream PACS Premium (the record lists the product as MedDream PACS Server)
- Affected: 7.3.3.840
- Component: CServerSettings::SetRegistryValues
- Fixed: not named in the record
The record says that a specially crafted application can decrypt credentials stored in a configuration related registry key, because of incorrect default permissions. It also says an attacker can run a malicious script or application to exploit this.
The attack vector is local, not network. The vector shows that no privileges and no user interaction are required, and that the scope changes. That means the attacker needs to be able to run something on the machine, but once they do, the effect can go beyond the component itself. The Talos report for this issue is TALOS-2025-2154. Cisco's site blocked my automated fetch, so I could not read it, and I cannot confirm a fixed version.
How to check if you're exposed
This is a Windows registry issue. On the server that runs MedDream, check the installed version from the programs list, or from the product's own about page. Version 7.3.3.840 is the one named in the record.
Then look at who can run code on that server. The attack needs a local application. Remote desktop users, service accounts, support tooling, and any other software on the host all count. Review local and remote logon rights, and see what else runs on the machine.
If you have access to a registry viewer, check the permissions on the MedDream configuration keys for groups that should not have read access. Do not change permissions on a production system until you have read the vendor guidance.
What to do now
- Read the Talos report TALOS-2025-2154 and contact MedDream for the fixed version and steps.
- Limit who can log on to the PACS server, locally or by remote desktop, to the staff who need it.
- Do not run other applications on the PACS host, and remove tools you do not need.
- Treat the credentials stored in that configuration as exposed if you suspect misuse, and rotate them. Find where else they are used.
- Monitor the server for new processes and logons that you do not expect.
Why it matters
The weakness is CWE-732 (incorrect permission assignment for a critical resource). Credentials were stored in a place that other local users or programs could read, and in a form that can be decrypted. Encryption does not protect a secret when the key and the data are both reachable by the same attacker.
Medical imaging servers hold patient data, and they are often connected to hospital networks, with uptime pressure that makes patching slow. The score of 9.3 reflects the changed scope and high impact on confidentiality, integrity and availability, even though the attacker must already be running code on the host.
The record does not say the flaw is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Can this be attacked over the internet?
The vector says local. The attacker needs to run an application on the server. A separate flaw that gives that access would make it more serious.
Is there a fixed version?
The record does not name one and I could not read the Talos report. Ask MedDream and read the report.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
