Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-14787

In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escalated privileges could access folders which contain executables where authenticated users have write permissions, and could then execute arbitrary code with local administrative permissions.

Published

2018-08-22T18:29:00.340

Last Modified

2024-11-21T03:49:47.560

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-269
Type: Primary
CWE-269

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	philips	intellispace_cardiovascular	≤ 3.1	Yes
Application	philips	xcelera	≤ 4.1	Yes

References

https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01 Third Party Advisory, US Government Resource ([email protected])
https://www.usa.philips.com/healthcare/about/customer-support/product-security Vendor Advisory ([email protected])
https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
https://www.usa.philips.com/healthcare/about/customer-support/product-security Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)