CVE-2025-27724 is a critical (CVSS 9.3) privilege escalation flaw in MedDream PACS Premium 7.3.3.840, a medical imaging server. A specially crafted PHP file uploaded to the login.php functionality can lead to elevated capabilities. Read the Talos report for the vendor fix and restrict access to the server.
What's affected
The record names MedDream PACS Premium 7.3.3.840 as affected. The report is TALOS-2025-2156 from Cisco Talos. The record does not name a fixed version, so confirm one with MedDream and the Talos report before you rely on a particular release.
The weakness is improper access control, CWE-284. The attack vector in the record is local (AV:L) with low complexity and no privileges, but the description says an attacker can upload a malicious file, so check how files can reach the server in your deployment.
Severity in the record: critical, CVSS 9.3, vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Weakness classes: CWE-284 (Improper access control).
How to check if you're exposed
This is a server product, so check the application directly.
- Find every MedDream PACS server in your estate, including test and research instances.
- Read the installed version from the product's admin or about page and compare it with 7.3.3.840 and the fixed version in the vendor communication.
- Check which accounts and which network paths can upload files to the server, and whether the web root is writable by the web service account.
- Look at the web root for PHP files that you did not deploy.
What to do now
- Contact MedDream or read the Talos report TALOS-2025-2156 to identify the fixed version, and schedule the upgrade with clinical engineering.
- Keep the server off the internet and limit it to the hospital or clinic network segments that need it.
- Remove write permission from the web root for the service account where the product allows it.
- Review the web root and the upload directories for unexpected PHP files and unfamiliar changes.
- Review accounts that can log in to the server and remove any that are unused.
- Make sure backups of the imaging data and configuration are recent and stored offline.
Why it matters
Access control flaws (CWE-284) are cases where the software lets a user do more than their role should allow. In this record the sequence is an upload of a crafted file that is then used to gain elevated capabilities on the server. The scope is changed, which means the impact moves beyond the component that was attacked, and all three impact scores are high.
Medical imaging servers hold patient data and are often hard to patch on a schedule, because upgrades involve clinical validation. That makes compensating controls, such as network segmentation and write protection on the web root, worth the effort while you wait for a change window.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Is a fixed version named in the record?
No. Use the Talos report and the vendor to confirm the fixed release.
Why is the vector local if the flaw involves an upload?
The record scores the attack vector as local with no privileges. How an attacker reaches the upload path in your deployment is something to confirm with the vendor and your own network design.
Sources
Last reviewed: 19 October 2026.
