Login Request a demo
Critical severity · published Jul 18, 2024
CVE-2023-40704
The product does not require unique and complex passwords to be created during installation
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Vue Pacs · Philips
before 12.2.8.410 · source: NVD
Affected product
VP
Vue Pacs
Philips
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-40704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-40704
Product
http://www.philips.com/productsecurity
Third Party Advisory
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01
More from Vue Pacs
9.8
CVE-2021-27501
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the…
9.8
CVE-2021-27497
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product
7.5
CVE-2021-33024
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or…
7.5
CVE-2021-33022
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors
7.5
CVE-2021-33020
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing…