PT-2018-18655 · Philips · Philips E-Alert Unit

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-8842

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Philips e-Alert Unit (non-medical device) versions R2.1 and prior

Description The software transmits sensitive data in cleartext over a communication channel, which can be intercepted by unauthorized actors. This lack of encryption could lead to the disclosure of personal contact information and application login credentials from within the same subnet.

Recommendations For Philips e-Alert Unit (non-medical device) versions R2.1 and prior, consider implementing encryption for the communication channel to protect sensitive data. As a temporary workaround, restrict access to the subnet where the Philips e-Alert Unit operates to minimize the risk of unauthorized interception.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2018-8842

Affected Products

Philips E-Alert Unit

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-8842 · Security Note
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8842 · Vendor Advisory
• http://securityfocus.com/bid/105194 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 · Note