Medium severity · published Sep 26, 2018
CVE-2018-14803
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
5.3
CVSS
1.7%
EPSS
No
On KEV
Description
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vulnerability that could allow attackers to obtain extraneous product information, such as OS and software components, via the HTTP response header that is normally not available to the attacker, but might be useful information in an attack.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
E-alert Firmware · Philips
through r2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14803
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14803
Third Party Advisory
http://www.securityfocus.com/bid/105194
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from E-alert Firmware
9.8
CVE-2018-8856
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
9.8
CVE-2018-8850
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
8.8
CVE-2018-8852
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
8.8
CVE-2018-8844
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
8.8
CVE-2018-8842
Philips e-Alert Unit (non-medical device), Version R2.1 and prior