Skip to main content

Philips Vue PACS Vulnerabilities

Philips have released a series of mitigations for a range of vulnerabilities in Philips Vue PACS products.

Threat ID:
CC-3897
Threat Severity:
Information only
Published:
8 July 2021 12:19 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Philips have released a series of mitigations for a range of vulnerabilities in Philips Vue PACS products.

Affected platforms

The following platforms are known to be affected:

Philips Vue PACS Versions: 12.2.x.x and prior

Philips Vue MyVue Versions: 12.2.x.x and prior

Philips Vue Speech Versions: 12.2.x.x and prior

Philips Vue Motion: Versions 12.2.1.5 and prior

Threat details

Philips have announced the following vulnerabilities in Philips Vue PACS products. 

  • Cleartext transmission of sensitive information
  • Improper restriction of operations within the bounds of a memory buffer
  • Improper input validation
  • Improper authentication
  • Improper initialisation
  • Use of a broken or risky cryptographic algorithm
  • Protection mechanism failure
  • Use of a key past its expiration date
  • Insecure default initialisation of resource
  • Improper handling of unicode encoding
  • Insufficiently protected credentials
  • Data integrity issues
  • Cross-site scripting
  • Improper neutralisation
  • Use of obsolete function
  • Relative path traversal

An unauthorised person or process could exploit these vulnerabilities to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorised software, or affect system data integrity.

Remediation advice

Affected organisations are advised to read the CISA advisory icsma-21-187-01 and apply the following mitigations recommended by Philips to address these vulnerabilities. Any questions can be directed to Phillips for more information.

Philips has released the following plans to address these vulnerabilities:

  • Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter.
  • Philips released Version 12.2.1.5 in June of 2020 for MyVue that remediates CWE-693 and recommends contacting support below.
  • Philips released Version 12.2.1.5 in June of 2020 for Vue Motion that remediates CWE-324 and recommends contacting support below.
  • Philips released Version 12.2.8.0 in May of 2021 for Speech that remediates CWE-693, CWE-319, CWE-119, CWE-287, and CWE-1214 and recommends contacting support below.
  • Philips released Version 12.2.8.0 in May of 2021 for PACS that remediates CWE-20, CWE-119, CWE-287 and recommends contacting support below.
  • Philips released a security fix for Speech in Nov 2021 that remediates CWE-665 and CWE-327 and recommends contacting support below.
  • Philips released version 12.2.1.6 in December 2021 for VuePAC (WFM), Vue Motion (Enterprise Viewer), Vue Explorer, and Web System Configuration that remediates CWE-23. 
  • Philips released Version 12.2.8.100 in Q1 / 2022 for MyVue that remediates CWE-665 and CWE-710  and recommends contacting support below.
  • Philips released Version 12.2.8.100 in Q1 / 2022 for PACS that remediates CWE-79, CWE-693, CWE-665, CWE-1188, CWE-327, CWE-176, CWE-522, CWE-710, and CWE-707 and recommends contacting support below.
  • Philips will release a fix for PACS that remediates CWE-522 with low score of 3.7 in Q3 2023.

Please see the Philips product security website for the latest security information for Philips products.

CVE Vulnerabilities

Status Published

CVE-2021-33024

Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.
Status Published

CVE-2021-33022

Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Status Published

CVE-2021-33020

Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Status Published

CVE-2021-33018

The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.
Status Published

CVE-2021-27501

Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
Status Published

CVE-2021-27497

Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Status Published

CVE-2021-27493

Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Status Published

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. (more)...
Status Published

CVE-2019-9636

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). (more)...
Status Published

CVE-2018-12326

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
Status Published

CVE-2018-11218

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Status Published

CVE-2018-10115

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
Status Published

CVE-2018-8014

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Status Published

CVE-2015-9251

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Status Published

CVE-2012-1708

Unspecified vulnerability in the Application Express component in Oracle Database Server 4.0 and 4.1 allows remote attackers to affect integrity via unknown vectors.
Status Reserved

CVE-2021-39369

Last edited: 23 February 2023 4:04 pm