CVE-2018-14787

Published: Aug 22, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escalated privileges could access folders which contain executables where authenticated users have write permissions, and could then execute arbitrary code with local administrative permissions.

Affected (2)

Products: Philips: Intellispace Cardiovascular, Xcelera

2 products

Intellispace Cardiovascular

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Philips Intellispace Cardiovascular	Up to 3.1
Philips Xcelera	Up to 4.1

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (4)

https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.usa.philips.com/healthcare/about/customer-support/product-security

Source: ics-cert@hq.dhs.gov

Vendor Advisory

https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.usa.philips.com/healthcare/about/customer-support/product-security

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.