Low severity · published Aug 22, 2018
CVE-2018-14799
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user
3.7
CVSS
0.5%
EPSS
No
On KEV
Description
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Physical
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
Pagewriter Tc10 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc20 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc30 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc50 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc70 Firmware · Philips
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14799
Third Party Advisory
http://www.securityfocus.com/bid/105103
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from Pagewriter Tc10 Firmware
6.2
CVE-2018-14801
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the…