VULNERABILITY INTELLIGENCE

CVE-2022-2120

CVSS score7.5 HIGH
EPSS probability3.37%
CISA KEVNot currently listed
Published2022-06-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

Weakness classification

  • ics-cert@hq.dhs.gov: CWE-23
  • nvd@nist.gov: CWE-22

Primary references