Images and videos can be transferred to a PACS server. The following formats and protocols are used during the transfer
from the displaying unit to the PACS server:
Item
Format
Protocols
Comments
Images
DICOM object / PNG
DICOM without CMS
Can use either Wi-Fi or LAN communication.
Video
DICOM object / MP4
(h.264)
DICOM without CMS
Can use either Wi-Fi or LAN communication.
Appendix 3.3 Cybersecurity Bill Of Materials (CBOM)
The following main off-the-shelf software components are used in the displaying unit.
The main known vulnerabilities of each component are included with an explanation of, why they are acceptable for this
application. Vulnerabilities with a low CVSS score are omitted in this list as a consequence of the low security risk rating of
the displaying unit.
Title
Version
Used for
Known vulnerabilities from NVD (CVSS score)
Qt
5.12
Qt is used for the
graphical user interface
(GUI).
CVE-2019-18281 (7.5)
Can cause denial of service, by handcrafting text file containing
directional characters.
In the displaying unit there are no known interactions which allows
text files from a user to be loaded into Qt.
Boost
1.68.0
Boost is used for IO file
interaction and
asynchronous handling.
The only known exploits in IO file handling for boost are for XSS
exploits for web environment, which is not used in displaying unit.
Libyaml
0.6.2
Is used to parse YAML files
on the device.
YAML files are used for
configuration, including
keys and values.
CVE-2019-6292 (6.5)
CVE-2019-6285 (6.5)
CVE-2018-20574 (6.5)
CVE-2018-20573 (6.5)
3 of these are handcrafted malicious YAML files causing a
denial of service and one causing a stack exhaustion.
The displaying unit does not allow any external YAML file to be
added to the device.
SQLite
3.22
Main database.
None
Linux
Linux
Kernel
version
4.4
The embedded Linux
kernel is built custom
by Ambu.
Many known issues, but none of these are critical to the
Displaying Unit.
Some of the media and interactions kernel are
described below.
46