High severity · published Mar 26, 2018
CVE-2018-5470
Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that has been identified, which may allow an authorized local…
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that has been identified, which may allow an authorized local user to execute arbitrary code and escalate their level of privileges.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Intellispace Portal · Philips
8.0; 9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5470
Third Party Advisory
http://www.securityfocus.com/bid/103182
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from Intellispace Portal
8.8
CVE-2017-0143
Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
7.8
CVE-2017-0199
Microsoft Office and WordPad Remote Code Execution Vulnerability
9.8
CVE-2018-5474
Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the…
9.8
CVE-2018-5472
Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some…
9.8
CVE-2018-5468
Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases…