High severity · published May 4, 2018
CVE-2018-8853
Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots by default with elevated Windows privileges, enabling a kiosk application, user, or an attacker to potentially attain unauthorized elevated privileges in Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior. Also, attackers may gain access to unauthorized resources from the underlying Windows operating system.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Brilliance CT Big Bore Firmware · Philips
through 2.3.5 · source: NVD
BF
Brilliance Firmware 64 · Philips
through 2.6.2 · source: NVD
BI
Brilliance Ict Firmware · Philips
through 4.1.6 · source: NVD
BI
Brilliance Ict SP Firmware · Philips
through 3.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8853
Third Party Advisory
http://www.securityfocus.com/bid/104088
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-123-01
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from Brilliance CT Big Bore Firmware
8.7
CVE-2018-8861
Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4…
7.8
CVE-2018-8857
Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big…
