Critical 7 exploited CVEs ICSMA-18-058-02 35 CVEs

Philips Intellispace Portal ISP Vulnerabilities

Published Feb 27, 2018 · Updated Feb 27, 2018

Vendor: Phillips Product: IntelliSpace Portal 7.0.x Product: IntelliSpace Portal 8.0.x

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to sensitive information, perform man-in-the-middle attacks, create denial of service conditions, or execute arbitrary code.

Vulnerabilities 35

High 8.8

CVE-2017-0143 Exploited · Ransomware Public exploit EPSS 93%

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

Microsoft Windows SMB Windows

Mar 17, 2017
KEV Nov 3, 2021
High 8.8

CVE-2017-0144 Exploited · Ransomware Public exploit EPSS 99%

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

Microsoft Windows SMB Windows

Mar 17, 2017
KEV Feb 10, 2022
High 8.8

CVE-2017-0145 Exploited · Ransomware Public exploit EPSS 90%

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

Microsoft Windows SMB Windows

Mar 17, 2017
KEV Feb 10, 2022
High 8.8

CVE-2017-0146 Exploited · Ransomware Public exploit EPSS 90%

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

Microsoft Windows SMB Windows

Mar 17, 2017
KEV Mar 25, 2022
High 8.1

CVE-2017-0148 Exploited · Ransomware Public exploit EPSS 99%

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

Microsoft Windows SMB Windows

Mar 17, 2017
KEV Apr 6, 2022
High 7.8

CVE-2017-0199 Exploited · Ransomware Public exploit EPSS 99%

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windo…

Microsoft Office/WordPad

Apr 12, 2017
KEV Nov 3, 2021
High 7.5

CVE-2017-0147 Exploited · Ransomware Public exploit EPSS 100%

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

Microsoft Windows SMB Windows

Mar 17, 2017
KEV May 24, 2022
Critical 9.8

CVE-2004-2761 Public exploit EPSS 10%

The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to c…

Jan 5, 2009
High 7.5

CVE-2016-2183 Public exploit EPSS 95%

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a b…

openjdk-8 openssl openjdk-7 openssl Ubuntu Alpine

Sep 1, 2016
High 7.4

CVE-2005-1794 Public exploit EPSS 18%

Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 stores an RSA private key in mstlsapi.dll and uses it…

Jun 1, 2005
Low 3.4

CVE-2014-3566 Public exploit EPSS 100%

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which ma…

openssl openssl openjdk-7 wolfssl Debian Ubuntu

Oct 15, 2014
Unscored —

CVE-2011-3389 Public exploit EPSS 73%

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firef…

asterisk curl bouncycastle nss Debian

Sep 6, 2011
Unscored —

CVE-2017-0267 EPSS 13%

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0268

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0269

The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted reques…

Microsoft Server Block Message 1.0

May 12, 2017
Unscored —

CVE-2017-0270

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0271 EPSS 13%

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0272 EPSS 17%

The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0273

The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted reques…

Microsoft Server Block Message 1.0

May 12, 2017
Unscored —

CVE-2017-0274

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0275

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0276

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…

Microsoft Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0277 EPSS 11%

The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…

Microsoft Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0278 EPSS 11%

The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…

Microsoft Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0279 EPSS 11%

The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…

Microsoft Server Message Block 1.0

May 12, 2017
Unscored —

CVE-2017-0280

The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted reques…

Microsoft Server Block Message 1.0

May 12, 2017
Unscored —

CVE-2018-5454

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enab…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5458

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that coul…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5462

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability t…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5464

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5466

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this coul…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5468

Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5470

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that…

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5472

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could …

Philips Philips IntelliSpace Portal

Mar 26, 2018
Unscored —

CVE-2018-5474

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remo…

Philips Philips IntelliSpace Portal

Mar 26, 2018

Revision history

2018-02-27 #1
ICSMA-18-058-02 Philips Intellispace Portal ISP Vulnerabilities

References

ICSA Advisory ICSMA-18-058-02 - Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B