Lucene search

IcscertCVE-2018-8857

HistoryMay 04, 2018 - 5:29 p.m.

CVE-2018-8857

2018-05-0417:29:00

CWE-798

icscert

web.nvd.nist.gov

philips

brilliance ct

software

fixed credentials

unauthorized access

cve-2018-8857

nvd.

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior) contains fixed credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. An attacker could compromise these credentials and gain access to the system.

Affected configurations

Nvd

Node

philipsbrilliance_firmware_64Range≤2.6.2

AND

philipsbrilliance_64Match-

Node

philipsbrilliance_ict_sp_firmwareRange≤3.2.4

AND

philipsbrilliance_ict_spMatch-

Node

philipsbrilliance_ict_firmwareRange≤4.1.6

AND

philipsbrilliance_ictMatch-

Node

philips_brilliance_ct_big_bore_firmwareRange≤2.3.5

AND

philips_brilliance_ct_big_boreMatch-

VendorProductVersionCPE
philipsbrilliance_firmware_64*cpe:2.3:o:philips:brilliance_firmware_64:*:*:*:*:*:*:*:*
philipsbrilliance_64-cpe:2.3:h:philips:brilliance_64:-:*:*:*:*:*:*:*
philipsbrilliance_ict_sp_firmware*cpe:2.3:o:philips:brilliance_ict_sp_firmware:*:*:*:*:*:*:*:*
philipsbrilliance_ict_sp-cpe:2.3:h:philips:brilliance_ict_sp:-:*:*:*:*:*:*:*
philipsbrilliance_ict_firmware*cpe:2.3:o:philips:brilliance_ict_firmware:*:*:*:*:*:*:*:*
philipsbrilliance_ict-cpe:2.3:h:philips:brilliance_ict:-:*:*:*:*:*:*:*
philips_brilliance_ct_big_bore_firmware*cpe:2.3:o:philips:_brilliance_ct_big_bore_firmware:*:*:*:*:*:*:*:*
philips_brilliance_ct_big_bore-cpe:2.3:h:philips:_brilliance_ct_big_bore:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
philips	brilliance_firmware_64	*	cpe:2.3:o:philips:brilliance_firmware_64::::::::
philips	brilliance_64	-	cpe:2.3:h:philips:brilliance_64:-:::::::*
philips	brilliance_ict_sp_firmware	*	cpe:2.3:o:philips:brilliance_ict_sp_firmware::::::::
philips	brilliance_ict_sp	-	cpe:2.3:h:philips:brilliance_ict_sp:-:::::::*
philips	brilliance_ict_firmware	*	cpe:2.3:o:philips:brilliance_ict_firmware::::::::
philips	brilliance_ict	-	cpe:2.3:h:philips:brilliance_ict:-:::::::*
philips	_brilliance_ct_big_bore_firmware	*	cpe:2.3:o:philips:_brilliance_ct_big_bore_firmware::::::::
philips	_brilliance_ct_big_bore	-	cpe:2.3:h:philips:_brilliance_ct_big_bore:-:::::::*

CNA Affected

[
  {
    "product": "Brilliance CT Scanners",
    "vendor": "Philips",
    "versions": [
      {
        "status": "affected",
        "version": "Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior."
      }
    ]
  }
]

References

www.securityfocus.com/bid/104088

ics-cert.us-cert.gov/advisories/ICSMA-18-123-01

www.usa.philips.com/healthcare/about/customer-support/product-security

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

Related for CVE-2018-8857