Medium severity · published Aug 22, 2018
CVE-2018-14801
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the…
6.2
CVSS
0.4%
EPSS
No
On KEV
Description
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset existing passwords.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
Pagewriter Tc10 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc20 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc30 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc50 Firmware · Philips
All versions, or not specified · source: NVD
PT
Pagewriter Tc70 Firmware · Philips
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14801
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14801
Third Party Advisory
http://www.securityfocus.com/bid/105103
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from Pagewriter Tc10 Firmware
3.7
CVE-2018-14799
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user