High severity · published Sep 26, 2018
CVE-2018-8854
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
7.5
CVSS
2.5%
EPSS
No
On KEV
Description
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources requested or influenced by an actor, which can be used to consume more resources than intended.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
E-alert Firmware · Philips
through r2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8854
Third Party Advisory
http://www.securityfocus.com/bid/105194
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from E-alert Firmware
9.8
CVE-2018-8856
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
9.8
CVE-2018-8850
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
8.8
CVE-2018-8852
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
8.8
CVE-2018-8844
Philips e-Alert Unit (non-medical device), Version R2.1 and prior
8.8
CVE-2018-8842
Philips e-Alert Unit (non-medical device), Version R2.1 and prior