Summary
Successful exploitation of this vulnerability could result in unencrypted communication and potential improper disclosure of sensitive data.
Vulnerabilities 1
-
Medium 5.9
Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor
The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information.
Revision history
-
#1
Initial Publication
References
-
ICSA Advisory ICSMA-18-137-02 - Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-137-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B