PT-2017-13256 · Philips · Philips Xcelera+1

Published 2017-11-17 · Updated 2019-10-03 · CVE-2017-14111

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Philips IntelliSpace Cardiovascular versions 2.3.0 and earlier Philips Xcelera versions R4.1L1 and earlier

Description The workstation logging function in the affected software records domain authentication credentials. If an attacker accesses these credentials, they can use them to access the application or other user entitlements.

Recommendations For Philips IntelliSpace Cardiovascular versions 2.3.0 and earlier, update to a version later than 2.3.0 to resolve the issue. For Philips Xcelera versions R4.1L1 and earlier, update to a version later than R4.1L1 to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2017-14111

Affected Products

Philips Intellispace Cardiovascular

Philips Xcelera

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-14111 · Security Note
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14111 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-318-01 · Note
• http://securityfocus.com/bid/101850 · Note