High severity · published May 4, 2018
CVE-2018-8861
Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4…
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior) could enable a limited-access kiosk user or an unauthorized attacker to break-out from the containment of the kiosk environment, attain elevated privileges from the underlying Windows OS, and access unauthorized resources from the operating system.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Brilliance CT Big Bore Firmware · Philips
through 2.3.5 · source: NVD
BF
Brilliance Firmware 64 · Philips
through 2.6.2 · source: NVD
BI
Brilliance Ict Firmware · Philips
through 4.1.6 · source: NVD
BI
Brilliance Ict SP Firmware · Philips
through 3.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8861
Third Party Advisory
http://www.securityfocus.com/bid/104088
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-123-01
Vendor Advisory
https://www.usa.philips.com/healthcare/about/customer-support/product-security
More from Brilliance CT Big Bore Firmware
8.8
CVE-2018-8853
Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system
7.8
CVE-2018-8857
Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big…
