PT-2022-9834 · Philips · Philips Vue Pacs

Published 2022-04-01 · Updated 2022-07-12 · CVE-2021-27493

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Philips Vue PACS versions 12.2.x.x and prior

Description The issue arises from the software not ensuring or incorrectly ensuring that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Recommendations For Philips Vue PACS versions 12.2.x.x and prior, consider restricting access to upstream and downstream components until a patch is available. As a temporary workaround, ensure that all data exchanged with the Philips Vue PACS is thoroughly validated to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Neutralization

Weakness Enumeration

CWE-707

Related Identifiers

CVE-2021-27493

Affected Products

Philips Vue Pacs

References · 6

• https://osv.dev/vulnerability/CVE-2021-27493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27493 · Security Note
• http://philips.com/productsecurity · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsma-21-187-01 · Note
• https://t.me/cvenotify/28311 · Telegram Post
• https://t.me/cibsecurity/40047 · Telegram Post