PT-2018-18655 · Philips · Philips E-Alert Unit

Publicado 2018-09-26 · Atualizado 2019-10-09 · CVE-2018-8842

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Philips e-Alert Unit (non-medical device) versions R2.1 and prior

Description The software transmits sensitive data in cleartext over a communication channel, which can be intercepted by unauthorized actors. This lack of encryption could lead to the disclosure of personal contact information and application login credentials from within the same subnet.

Recommendations For Philips e-Alert Unit (non-medical device) versions R2.1 and prior, consider implementing encryption for the communication channel to protect sensitive data. As a temporary workaround, restrict access to the subnet where the Philips e-Alert Unit operates to minimize the risk of unauthorized interception.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2018-8842

Produtos afetados

Philips E-Alert Unit

Referências · 5

• http://securityfocus.com/bid/105194 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8842 · Nota de Segurança
• https://usa.philips.com/healthcare/about/customer-support/product-security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-8842 · Aviso do Fabricante