Vendor
Philips
88 known vulnerabilities.
Philips at a glance
- Last 12 months
- 8
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 8 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 3 | 0 |
| Mar 2025 | 2 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
Latest advisories
-
Medium max 5.9
Philips MRI 1.5T and 3T (Update A)
Successful exploitation of these vulnerabilities may allow an attacker with operator level access to view system configuration, view system files, and export data (including patient data) to an untrusted environment.
first Nov 24, 2021 -
Criticalfirst Jul 7, 2013
-
High max 7.7ICSMA-25-072-01 2 CVEs
Philips Intellispace Cardiovascular (ISCV)
Successful exploitation of these vulnerabilities could allow an attacker to replay the session of the logged in ISCV user and gain access to patient records.
-
Medium max 7.5
Philips Vue PACS (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to gain access to the database, which could impact system availability and data integrity or cause a denial-of-service condition.
first Jul 18, 2024 -
Medium
Philips Patient Monitoring Devices (Update C)
Successful exploitation of these vulnerabilities could result in unauthorized access, interrupted monitoring, and collection of access information and/or patient data. To successfully exploit these vulnerabilities, an attacker would need to gain either physic…
first Sep 10, 2020
88 results · Feed
-
Medium 6.3
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exp…
-
High 8.0
Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability
Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication i…
-
High 8.8
Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability
Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication i…
-
High 8.1
Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability
Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to ex…
-
High 8.1
Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability
Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not requ…
-
High 8.0
Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although…
-
High 8.8
Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability
Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not require…
-
High 8.0
Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability
Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interac…
-
High 7.2
Use of default hardcoded credentials
We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a…
-
High 7.3
Unauthenticated Remote Code Execution via .NET Deserialization
The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had se…
-
High 7.7
3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel
The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the "Object Marshalling" technique, which allows an attacker to read internal files without any authentication…
-
High 7.7
Philips Intellispace Cardiovascular (ISCV) Use of Weak Credentials
A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across all installations.
-
High 7.7
Philips Intellispace Cardiovascular (ISCV) Improper Authentication
A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass.
-
Medium 6.8
Philips Vue PACS Use of Default Credentials
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system…
-
Medium 5.9
Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor
The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information.
-
Low 3.7
Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information
Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may …
-
Medium 6.5
ICSMA-22-088-01 Philips e-Alert
The software does not perform any authentication for critical system functionality.
-
High 7.5
Philips Vue PACS Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.
-
High 7.5
Philips Vue PACS Cleartext Transmission of Sensitive Information
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
Medium 6.5
Philips Vue PACS Protection Mechanism Failure
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
-
Low 3.7
Philips Vue PACS Insufficiently Protected Credentials
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.
-
High 8.2
Philips Vue PACS Use of a Key Past its Expiration Date
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
-
High 7.5
Philips Vue PACS Improper Adherence to Coding Standards
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
-
Medium 6.1
Philips Vue PACS
Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
-
Low 2.4
Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control
Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.
-
Low 2.6
ICSMA-22-006-01 Philips Engage Software
The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.
-
Medium 5.9
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between Patient Information Center iX (PIC iX) Versions C.02 and C.03 and Efficia CM Series …
-
Medium 6.1
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key
The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.
-
Medium 6.5
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input Validation
Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
-
High 8.1
Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel
The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
-
High 8.1
Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials
IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
-
Medium 5.9
Philips MRI 1.5T and 3T Incorrect Ownership Assignment
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
-
Medium 5.9
Philips MRI 1.5T and 3T Information Exposure
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
-
Medium 5.9
Philips MRI 1.5T and 3T Improper Access Control
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
-
Medium 6.5
Philips Interventional Workstations OS Command Injection
Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced …
-
Medium 6.8
Philips Clinical Collaboration Platform Configuration
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
-
Medium 6.5
Philips Clinical Collaboration Platform Algorithm Downgrade
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not properly control the allocation and maintenance of a limited resource, thereby enabling an attacker to influence the amount of resources consumed, eventually leading to the exhaustio…
-
Medium 5.0
Philips Clinical Collaboration Platform Protection Mechanism Failure
When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct.
-
Low 3.5
Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web Page
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a webpage that is served to other users.
-
Low 3.4
Philips Clinical Collaboration Platform Cross-site Request Forgery
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.