Medium severity · published Dec 27, 2021
CVE-2021-43552
The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02,…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Patient Information Center IX · Philips
b.02; c.02; c.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43552
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-02
More from Patient Information Center IX
8.8
CVE-2020-16222
In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given identity, the software…
6.8
CVE-2020-16212
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate…
6.5
CVE-2021-43550
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between…
6.5
CVE-2021-43548
Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to…
6.5
CVE-2020-16224
In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that…