Medium severity · published Apr 1, 2022
CVE-2021-27493
Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
Myvue · Philips
before 12.2.1.5 · source: NVD
SP
Speech · Philips
before 12.2.8.0 · source: NVD
VM
Vue Motion · Philips
before 12.2.1.5 · source: NVD
VP
Vue Pacs · Philips
before 12.2.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27493
Vendor Advisory
http://www.philips.com/productsecurity
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01
More from Myvue
9.8
CVE-2021-27501
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the…
9.8
CVE-2021-27497
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product
7.5
CVE-2021-33024
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or…
7.5
CVE-2021-33022
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors
7.5
CVE-2021-33020
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing…