CVE-2024-23622

The vulnerability consists of a stack-based buffer overflow in the eFilm Workstation license server component — specifically in the CopySLS_Request3 function. An attacker can send a specially crafted network request to the license server without requiring authentication, which leads to stack memory being overwritten. Successful exploitation of the vulnerability allows arbitrary code execution in the context of the server process running with SYSTEM privileges.

An attacker gains the ability to execute arbitrary code (RCE) with SYSTEM privileges on a vulnerable system, which means complete takeover of the host, including access to patient data and medical infrastructure.

Patches available from the manufacturer should be applied in accordance with references. As a temporary workaround, it is recommended to restrict network access to the eFilm Workstation license server port only to trusted hosts using a firewall, until the official patch is deployed.

IBM Merge Healthcare eFilm Workstation — versions indicated in manufacturer references; the vulnerable component is the license server