Your imaging server is probably on the internet

A late-2025 scan found 3,627 internet-accessible DICOM servers across more than 100 countries, about a third of them in the United States. Roughly 44% cluster into groups running identical software, which means a single vulnerability exploits hundreds of targets at once.

Orthanc is over-represented in that population, and the reason is straightforward: it is free, it is good, and it does not enable authentication by default when remote access is turned on. That behaviour is CVE-2025-0896, CVSS 9.8.

The typical path to exposure is not negligence. It is a Saturday. A radiologist needs remote access to read studies from home, somebody enables the remote interface to make that work, and the default configuration does exactly what it says it will do.

How to check yours

Scan your own external IP space for ports 104, 11112, and 8042. If anything answers, verify whether it requires authentication before you do anything else. You can do this yourself in ten minutes with nmap; you do not need a vendor.

We run this sweep as part of every assessment for orthopaedics, ophthalmology, podiatry, and ambulatory surgery centres. We find something more often than we would like to.

What to do about it

1. Take it off the internet. Remote reading goes through a VPN with multi-factor authentication or a published remote desktop path with MFA, not through an exposed DICOM port.
2. Enable authentication regardless. Even on an internal segment. Defence in depth is the whole argument for it, and a flat internal network makes "internal" mean very little.
3. Segment the modalities. Imaging equipment belongs on its own segment with deny-by-default egress. Most modalities have no legitimate reason to reach the internet at all.
4. Inventory it and document the compensating controls. Under §164.310(d)(2)(iii) the device is in scope whether or not the vendor supports patching it. "It's the vendor's device" is not a scope exclusion; it just determines who is allowed to touch it.

The wider point

About 19% of connected medical devices run unsupported operating systems, and device lifespan of ten to twenty years outlives OS support by design. FDA-cleared device software often cannot be patched without revalidation.

Which means that for a large share of clinical equipment, patching is not available as a control at all. Segmentation and deny-by-default egress are the only real options, plus a documented rationale for every device that cannot be patched.

A generalist IT provider has no playbook for a device it is contractually forbidden from touching, which is why these boxes tend to sit unexamined for years on the same network as the scheduling system.