Vulnerability CVE-2018-14787


Published: 2018-08-22

Description:
In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escalated privileges could access folders which contain executables where authenticated users have write permissions, and could then execute arbitrary code with local administrative permissions.

Type:

CWE-269

(Improper Privilege Management)

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.6/10
6.4/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Phillips -> Intellispace cardiovascular 
Phillips -> Xcelera 

 References:
https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01
https://www.usa.philips.com/healthcare/about/customer-support/product-security

Copyright 2024, cxsecurity.com

 

Back to Top