Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-14789

In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search path or element vulnerability has been identified, which may allow an attacker to execute arbitrary code and escalate their level of privileges.

Published

2018-08-22T18:29:00.433

Last Modified

2024-11-21T03:49:47.833

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.7 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-428
Type: Primary
CWE-428

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	philips	intellispace_cardiovascular	≤ 3.1	Yes
Application	philips	xcelera	≤ 4.1	Yes

References

https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01 Third Party Advisory, US Government Resource ([email protected])
https://www.usa.philips.com/healthcare/about/customer-support/product-security Vendor Advisory ([email protected])
https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
https://www.usa.philips.com/healthcare/about/customer-support/product-security Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)