PT-2018-18657 · Philips · Philips E-Alert Unit

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-8844

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Philips e-Alert Unit (non-medical device) versions R2.1 and prior

Description The web application of the Philips e-Alert Unit does not sufficiently verify whether a request was intentionally provided by the user who submitted it, which can lead to potential issues.

Recommendations For versions R2.1 and prior, consider implementing additional request validation mechanisms to ensure that only well-formed and valid requests are processed by the web application. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-8844

Affected Products

Philips E-Alert Unit

References · 5

• https://osv.dev/vulnerability/CVE-2018-8844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8844 · Security Note
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• http://securityfocus.com/bid/105194 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 · Note