High severity · published Apr 1, 2022
CVE-2021-33020
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
Myvue · Philips
before 12.2.1.5 · source: NVD
SP
Speech · Philips
before 12.2.8.0 · source: NVD
VM
Vue Motion · Philips
before 12.2.1.5 · source: NVD
VP
Vue Pacs · Philips
before 12.2.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33020
Vendor Advisory
http://www.philips.com/productsecurity
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01
More from Myvue
9.8
CVE-2021-27501
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the…
9.8
CVE-2021-27497
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product
7.5
CVE-2021-33024
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or…
7.5
CVE-2021-33022
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors
7.5
CVE-2021-33018
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive…