Skip to content
OpenAdvisories
Medium ICSMA-24-200-01 2 CVEs

Philips Vue PACS (Update A)

Published Jul 18, 2024 · Updated Nov 21, 2024 · Revision 2

Vendor: Philips Product: Vue PACS

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain access to the database, which could impact system availability and data integrity or cause a denial-of-service condition.

Vulnerabilities 2

  • High 7.5
    CVE-2021-28165 Public exploit EPSS 54%

    Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  • Medium 6.8
    CVE-2023-40704

    Philips Vue PACS Use of Default Credentials

    The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system…

    Philips Vue PACS

Revision history

  1. #2

    Update A - Vulnerabilities removed due to further analysis by Philips showing they did not affect the device or had no security impact.

  2. #1

    Initial Publication

References