WWBN, Med Dream, Eclipse vulnerabilities
Summary: Cisco Talos disclosed seven vulnerabilities in WWBN AVideo, four in MedDream PACS Premium, and one in an Eclipse ThreadX FileX module, all patched by their vendors. The AVideo findings include five cross-site scripting flaws in version 14.4 and dev master commit 8a8954ff, plus two flaws that chain to arbitrary code execution: a race condition in aVideoEncoder.json.php (CVE-2025-25214) and an incomplete .htaccess blacklist (CVE-2025-48732) triggered by requesting a .phar file.
What's compelling: The MedDream findings land in a DICOM 3.0 picture archiving and communication system used across CR, DX, CT, MR, US and XA modalities, and include an unauthenticated SSRF in cecho.php (CVE-2025-24485) plus a privilege escalation via uploaded .php files (CVE-2025-27724) - a medical imaging server reachable without credentials is a different order of exposure than a streaming platform.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-24485CVE-2025-25214CVE-2025-26469CVE-2025-27724CVE-2025-32731CVE-2025-48732
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026