15 Philips Vue Vulnerabilities Could Result in Full Takeover of the Devices

CISA has released an advisory about several vulnerabilities found in Philips Vue PACS health devices. In the hands of a hacker, the 15 Philips Vue Vulnerabilities found in the Philips Clinical Collaboration Platform Portal might lead to remote code execution attacks. 

The danger that these vulnerabilities pose, according to CISA (the United States Cybersecurity and Infrastructure Security Agency), is as follows: 

Successful exploitation of these vulnerabilities could allow an unauthorized person or process to hear in on conversations, view or alter data, gain system access, execute code, install unauthorized software, or compromise system data integrity, all of which could compromise the system’s confidentiality, integrity, or availability. 

The vulnerabilities demand immediate attention and patching since four of the fifteen have a CVSS rating of 9.8. (Common Vulnerability Scoring System). 

The discovered vulnerabilities were characterized as follows in the advisory released for informational purposes, according to the CISA website: 

#1 CVE-2020-1938: 9.8 CVSS scored flaw caused by improper validation of the received data. 

#2 CVE-2018-12326 and CVE-2018-11218: the software that works through a memory buffer cannot read or write to an outside of the buffer area memory location. It can be found on the Redis component. 

#3 CVE-2020-4670: scored with 9.8 CVSS, it’s caused by improper authentication. The Redis Software cannot assert the validity of the threat actor’s given identity claim. 

#4 CVE-2018-8014: the default set by the software is not secure (it’s intended to be modified by the administrator). 

#5 CVE-2021-33020: expired passwords and cryptographic keys the product uses lead to increasing the timing window. 

#6 CVE-2018-10115: it exists in the third-party component 7-Zip. Incorrect initialization of the resource leads to unexpected status. 

#7 CVE-2021-27501: specific development coding rules are not implemented by the software. 

#8 CVE-2021-33018: a damaged algorithm of cryptography might lead to data leakage. 

#9 CVE-2021-27497: the protection mechanism is not properly used by the product. 

#10 CVE-2012-1708: it lies in the third-party Oracle Database component and is related to data integrity. 

#11 CVE-2015-9251: user-controllable input is not correctly neutralized before locating it in output. 

#12 CVE-2021-27493: structured data or messages are not ensured in a proper way. 

#13 CVE-2019-9636: the Unicode encoding from the input is not accurately managed by the software. 

#14 CVE-2021-33024: the method to protect authentication credentials is insecure. 

#15 CVE-2021-33022: the communication channel through which sensitive data is transmitted might be sniffed. 

According to reports, the impacted devices are Vue Speech 12.2 and previous variants, Vue Motion and Philips Vue PACS, MyVue. Some of them have been fixed, while others will not receive security upgrades until 2022.

Safety measures: 

A reasonable strategy, according to SCMagazine, would be to limit the gadgets’ network connections. Administrators should be in charge of remote devices and control system networks; they must separate them from the company’s network and place them behind firewalls. 

However, if certain appliances with Philips Vue vulnerabilities are to be utilized remotely, it is not suggested to do so without a secure connection, such as an updated VPN.