In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
J4Care has provided a fix for the vulnerability. J4Care recommends users implement release 5.35.2 or later.