PT-2018-18665 · Philips+1 · Brilliance 64+3

Published 2018-05-04 · Updated 2019-10-09 · CVE-2018-8853

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Philips Brilliance CT devices versions prior to the following: Brilliance 64 version 2.6.2 Brilliance iCT version 4.1.6 Brilliance iCT SP version 3.2.4 Brilliance CT Big Bore version 2.3.5

Description The issue allows a kiosk application, user, or an attacker to potentially attain unauthorized elevated privileges due to the default boot configuration of the Microsoft Windows operating system with elevated Windows privileges. This could also enable attackers to gain access to unauthorized resources from the underlying Windows operating system.

Recommendations For Brilliance 64 version 2.6.2 and prior, update to a version later than 2.6.2 to resolve the issue. For Brilliance iCT versions 4.1.6 and prior, update to a version later than 4.1.6 to resolve the issue. For Brilliance iCT SP versions 3.2.4 and prior, update to a version later than 3.2.4 to resolve the issue. For Brilliance CT Big Bore version 2.3.5 and prior, update to a version later than 2.3.5 to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-250

CWE-269

Related Identifiers

CVE-2018-8853

Affected Products

Brilliance 64

Brilliance Ct Big Bore

Brilliance Ict

Windows

References · 5

• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8853 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8853 · Vendor Advisory
• http://securityfocus.com/bid/104088 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-123-01 · Note