ICSMA-24-200-01

icsaUScisa_csaf_ot

Philips Vue PACS (Update A)

Advisory ansehen veröffentlicht 2024-07-18

Successful exploitation of these vulnerabilities could allow an attacker to gain access to the database, which could impact system availability and data integrity or cause a denial-of-service condition.

01

beschreibt (2)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2023-40704UScritical9.8OT erhöht—
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was…
CVE-2021-28165UShigh7.5Exploit
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (4)

  • MitigationVue PACS

    For CVE-2023-40704, Philips recommends no action needed due to low risk of exploitability, but customers can request that Philips update database password(s).

  • MitigationVue PACS

    Philips recommends the following mitigations:

  • BehobenVue PACS

    For CVE-2021-28165, Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter. Vue PACS version 12.2.8.410* released in October 2023 prevents this vulnerability.

    https://incenter.medical.philips.com/Default.aspx?tabid=867
  • BehobenVue PACS

    For managed services customers, new releases will be made available upon resource availability. Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact their local Philips sales representative or submit a request in the Philips Informatics Support portal.

    https://www.informatics.support.philips.com/csm
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan