by Kastro
Paper/Archive/CVE-2023-40704

CVE-2023-40704

Philips Vue PACS — Philips Vue PACS Use of Default Credentials

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 27.3.273 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

Affected

ProductAffectedFixed inSource
Vue PACS< 12.2.8.41012.2.8.410CNA
vue_pacs< 12.2.8.41012.2.8.410CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)6.8CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)5.7CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-24-200-01refphilips.com/productsecurity