Summary
Successful exploitation from an attacker within the same subnet may impact or compromise user contact details, unit integrity, and/or unit availability. The vulnerabilities may allow attackers to provide unexpected input into the application, execute arbitrary code, display unit information, or potentially cause e-Alert to crash.
Vulnerabilities 8
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vul…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits sensitive or security-critica…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The web application does not, or cannot, sufficientl…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neut…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect perm…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allow…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing…
-
Unscored —
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or …
Revision history
-
#1
ICSA-18-242-01 Philips e-Alert Unit
-
#2
ICSA-18-242-01 Philips e-Alert Unit (Update A)
References
-
ICS Advisory ICSA-18-242-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-242-01
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B