Action not permitted
Modal body text goes here.
cve-2017-0143
Vulnerability from cvelistv5
Published
2017-03-17 00:00
Modified
2024-08-05 12:55
Severity ?
EPSS score ?
Summary
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Microsoft Corporation | Windows SMB |
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog
Date added: 2021-11-03
Due date: 2022-05-03
Required action: Apply updates per vendor instructions.
Used in ransomware: Known
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0143
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T12:55:18.661Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "41891", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "url": "https://www.exploit-db.com/exploits/41891/" }, { "name": "96703", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/96703" }, { "name": "1037991", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1037991" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143" }, { "name": "41987", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "url": "https://www.exploit-db.com/exploits/41987/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf" }, { "name": "43970", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "url": "https://www.exploit-db.com/exploits/43970/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Windows SMB", "vendor": "Microsoft Corporation", "versions": [ { "status": "affected", "version": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607" } ] } ], "datePublic": "2017-03-14T00:00:00", "descriptions": [ { "lang": "en", "value": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148." } ], "problemTypes": [ { "descriptions": [ { "description": "Remote Code Execution", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-02-04T16:06:11", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "41891", "tags": [ "exploit", "x_refsource_EXPLOIT-DB" ], "url": "https://www.exploit-db.com/exploits/41891/" }, { "name": "96703", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/96703" }, { "name": "1037991", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1037991" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf" }, { "tags": [ "x_refsource_MISC" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143" }, { "name": "41987", "tags": [ "exploit", "x_refsource_EXPLOIT-DB" ], "url": "https://www.exploit-db.com/exploits/41987/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf" }, { "name": "43970", "tags": [ "exploit", "x_refsource_EXPLOIT-DB" ], "url": "https://www.exploit-db.com/exploits/43970/" }, { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html" }, { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "secure@microsoft.com", "ID": "CVE-2017-0143", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Windows SMB", "version": { "version_data": [ { "version_value": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607" } ] } } ] }, "vendor_name": "Microsoft Corporation" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Remote Code Execution" } ] } ] }, "references": { "reference_data": [ { "name": "41891", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/41891/" }, { "name": "96703", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96703" }, { "name": "1037991", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037991" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf" }, { "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143" }, { "name": "41987", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/41987/" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf" }, { "name": "43970", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/43970/" }, { "name": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html" }, { "name": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2017-0143", "datePublished": "2017-03-17T00:00:00", "dateReserved": "2016-09-09T00:00:00", "dateUpdated": "2024-08-05T12:55:18.661Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "cisa_known_exploited": { "cveID": "CVE-2017-0143", "cwes": "[\"CWE-20\"]", "dateAdded": "2021-11-03", "dueDate": "2022-05-03", "knownRansomwareCampaignUse": "Known", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2017-0143", "product": "Windows", "requiredAction": "Apply updates per vendor instructions.", "shortDescription": "Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.", "vendorProject": "Microsoft", "vulnerabilityName": "Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability" }, "nvd": "{\"cve\":{\"id\":\"CVE-2017-0143\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2017-03-17T00:59:03.977\",\"lastModified\":\"2024-07-25T14:00:11.533\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"cisaExploitAdd\":\"2021-11-03\",\"cisaActionDue\":\"2022-05-03\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \\\"Windows SMB Remote Code Execution Vulnerability.\\\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.\"},{\"lang\":\"es\",\"value\":\"El servidor SMBv1 en Microsoft Windows Vista SP2; Windows Server 2008 SP2 y R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold y R2; Windows RT 8.1 y Windows 10 Gold, 1511 y 1607 y Windows Server 2016 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de paquetes manipulados, vulnerabilidad tambi\u00e9n conocida como \\\"Windows SMB Remote Code Execution Vulnerability\\\". Esta vulnerabilidad es distinta de aquellas descritas en CVE-2017-0144, CVE-2017-0145, CVE-2017-0146 y CVE-2017-0148.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":9.3},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFFA22FC-A15A-4EB5-BED7-45F6EAFA8F80\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"542DAEEC-73CC-46C6-A630-BF474A3446AC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A8E9D99-BD78-4340-88F2-5AFF27AC37C9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61019899-D7AF-46E4-A72C-D189180F66AB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2B1C231-DE19-4B8F-A4AA-5B3A65276E46\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E93068DB-549B-45AB-8E5C-00EB5D8B5CF8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6CE5198-C498-4672-AF4C-77AB4BE06C5C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F422A8C-2C4E-42C8-B420-E0728037E15C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2ACA9287-B475-4AF7-A4DA-A7143CEF9E57\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF1AD1A1-EE20-4BCE-9EE6-84B27139811C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:philips:intellispace_portal:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"184A3E7A-9716-4594-9293-4ED708EF938F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:philips:intellispace_portal:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"374B9A63-793D-41A1-A02F-4642031DA5FA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0814F7B8-8022-4DCC-BE37-4868EB912881\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87A45473-9558-4165-949B-D63F1486F28E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59E3D131-8FDF-424C-9BBA-41FDAE43F24C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C270FA0-6961-4181-8388-E609DAEADC09\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C07C8A47-9E8F-42E4-BB35-64590853A9C5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"506F5373-3C3C-4F47-8FC0-D5F04095B324\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42DBCB0C-2C71-4427-ADF8-FCB4920609B7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C50335A-8742-4E2B-B22D-0ED0A0DFB5C4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndExcluding\":\"4.0e\",\"matchCriteriaId\":\"D4CFBFA2-BDE4-4566-A435-92BFB87C48E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DFBC156-20D1-4546-948F-A2118D602137\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70575FD4-0A0A-4D11-9069-F808D9F00D10\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1E644CD-EA9B-45B5-A7C6-5F294D8A6909\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F38DAB6-39E2-4048-A57D-C3EB8415F3F2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05BD2983-B780-46F0-A857-CFC614D1B524\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndExcluding\":\"4.0e\",\"matchCriteriaId\":\"99A99C16-9C4C-4BFF-B60A-A7BB67D7D397\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1753DB4B-1F5A-4193-A50C-C2A576F0884C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25CEAC4F-CBA5-41BA-B389-4D0DA3F85B59\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DE83393-E735-42BC-86E9-5DAF9F403C73\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5641B967-9938-4148-90C4-D92C3E757847\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"582D4D5C-D0F1-403D-8687-3F1491943A65\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68FE5E09-78BB-4A22-9CAA-93ECD7AC33A4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA7B7CC4-E89E-4357-A7D6-AF74480F46B5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41EF3913-CD35-49FD-90D8-62228DB1390C\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/96703\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1037991\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/41891/\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/41987/\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/43970/\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]}]}}" } }
icsma-20-170-01
Vulnerability from csaf_cisa
Published
2020-06-18 00:00
Modified
2020-06-23 00:00
Summary
Baxter ExactaMix (Update A)
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities could result in unauthorized access to sensitive data, alteration of system configuration, alteration of system resources, and impact to system availability.
Critical infrastructure sectors
Healthcare and Public Health
Countries/areas deployed
Worldwide
Company headquarters location
United States
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Exploitability
No known public exploits specifically target these vulnerabilities.
{ "document": { "acknowledgments": [ { "organization": "Baxter Healthcare", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities could result in unauthorized access to sensitive data, alteration of system configuration, alteration of system resources, and impact to system availability.", "title": "Risk evaluation" }, { "category": "other", "text": "Healthcare and Public Health", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "United States", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSMA-20-170-01 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsma-20-170-01.json" }, { "category": "self", "summary": "ICS Advisory ICSMA-20-170-01 Web Version", "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-170-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.fda.gov/medical-devices/digital-health/cybersecurity" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Baxter ExactaMix (Update A)", "tracking": { "current_release_date": "2020-06-23T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSMA-20-170-01", "initial_release_date": "2020-06-18T00:00:00.000000Z", "revision_history": [ { "date": "2020-06-18T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSMA-20-170-01 Baxter Exactamix " }, { "date": "2020-06-23T00:00:00.000000Z", "legacy_version": "A", "number": "2", "summary": "ICSMA-20-170-01 Baxter Exactamix (Update A)" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "1.10 | 1.11 | 1.13 | 1.14", "product": { "name": "ExactaMix EM2400: Versions 1.10 1.11 1.13 1.14", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "ExactaMix EM2400" }, { "branches": [ { "category": "product_version", "name": "1.1 | 1.2 | 1.4 | 1.5", "product": { "name": "ExactaMix EM1200: Versions 1.1 1.2 1.4 1.5", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "ExactaMix EM1200" } ], "category": "vendor", "name": "Baxter" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-12016", "cwe": { "id": "CWE-259", "name": "Use of Hard-coded Password" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 have hard-coded administrative account credentials for the ExactaMix operating system. Successful exploitation of this vulnerability may allow an attacker who has gained unauthorized access to system resources, including access to execute software or to view/update files, directories, or system configuration. This could allow an attacker with network access to view sensitive data including PHI.CVE-2020-12016 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12016" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2020-12012", "cwe": { "id": "CWE-259", "name": "Use of Hard-coded Password" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials for the ExactaMix application. Successful exploitation of this vulnerability may allow an attacker with physical access to gain unauthorized access to view/update system configuration or data. Thiscould impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI.CVE-2020-12012 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12012" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2020-12008", "cwe": { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including PHI.CVE-2020-12008 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12008" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2020-12032", "cwe": { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI. CVE-2020-12032 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12032" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2020-12024", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to the system the ability to load an unauthorized payload or unauthorized access to the hard drive by booting a live USB OS. This could impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI.CVE-2020-12024 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12024" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2020-12020", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user.CVE-2020-12020 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12020" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0143", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 does not validate or incorrectly validates input via the SMBv1 port that can affect the control flow or data flow of a system. The SMBv1 input validation vulnerabilities could allow a remote attacker to gain unauthorized access to sensitive information, create denial of service conditions, or execute arbitrary code.For details, refer to Microsoft Security Bulletin MS17-010 and NCCIC WannaCry fact sheet.CVE-2017-0143 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0143" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Baxter recommends that users of the ExactaMix EM 2400 Versions 1.10 and 1.11, and ExactaMix EM1200 Versions 1.1 and 1.2, should contact the service support team or regional product service support to upgrade to the ExactaMix Version 1.4 (EM1200) and ExactaMix Version 1.13 (EM2400) compounders.\nFor all users, Baxter recommends the following compensating controls including, but not limited to:", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "Baxter separately provided an ExactaMix Cybersecurity Guide, instructing users on good cybersecurity practices relevant to the use of the ExactaMix product. The guide can be requested from productsecurity@baxter.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "vendor_fix", "details": "For additional information please see the Baxter Product Security Bulletin.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.baxter.com/product-security#additionalresources" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] } ] }
icsma-18-058-02
Vulnerability from csaf_cisa
Published
2018-02-27 00:00
Modified
2018-02-27 00:00
Summary
Philips Intellispace Portal ISP Vulnerabilities
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to sensitive information, perform man-in-the-middle attacks, create denial of service conditions, or execute arbitrary code.
Critical infrastructure sectors
Healthcare and Public Health
Countries/areas deployed
Worldwide
Company headquarters location
United States
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:
Recommended Practices
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Recommended Practices
Do not click web links or open attachments in unsolicited email messages.
Recommended Practices
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Recommended Practices
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
{ "document": { "acknowledgments": [ { "organization": "Phillips", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to sensitive information, perform man-in-the-middle attacks, create denial of service conditions, or execute arbitrary code.", "title": "Risk evaluation" }, { "category": "other", "text": "Healthcare and Public Health", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "United States", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:", "title": "Recommended Practices" }, { "category": "general", "text": "Do not click web links or open attachments in unsolicited email messages.", "title": "Recommended Practices" }, { "category": "general", "text": "Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.", "title": "Recommended Practices" }, { "category": "general", "text": "Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.", "title": "Recommended Practices" } ], "publisher": { "category": "coordinator", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSMA-18-058-02 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2018/icsma-18-058-02.json" }, { "category": "self", "summary": "ICSA Advisory ICSMA-18-058-02 - Web Version", "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-02" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Philips Intellispace Portal ISP Vulnerabilities", "tracking": { "current_release_date": "2018-02-27T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSMA-18-058-02", "initial_release_date": "2018-02-27T00:00:00.000000Z", "revision_history": [ { "date": "2018-02-27T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSMA-18-058-02 Philips Intellispace Portal ISP Vulnerabilities" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "IntelliSpace Portal 8.0.x: *", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "IntelliSpace Portal 8.0.x" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "IntelliSpace Portal 7.0.x: *", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "IntelliSpace Portal 7.0.x" } ], "category": "vendor", "name": "Phillips" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-5474", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the application to crash.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5474" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0143", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0143" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0144", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0144" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0145", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0145" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0146", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0146" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0148", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0148" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0272", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0277, CVE-2017-0278, and CVE-2017-0279.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0272" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0277", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0272, CVE-2017-0278, and CVE-2017-0279.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0277" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.0, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0278", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0272, CVE-2017-0277, and CVE-2017-0279.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0278" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.0, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0279", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0272, CVE-2017-0277, and CVE-2017-0278.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0279" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.0, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0269", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka \"Windows SMB Denial of Service Vulnerability\". This CVE ID is unique from CVE-2017-0273 and CVE-2017-0280.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0269" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0273", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka \"Windows SMB Denial of Service Vulnerability\". This CVE ID is unique from CVE-2017-0269 and CVE-2017-0280", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0273" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0280", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka \"Windows SMB Denial of Service Vulnerability\". This CVE ID is unique from CVE-2017-0269 and CVE-2017-0273.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0280" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0147", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka \"Windows SMB Information Disclosure Vulnerability.\"", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0147" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0267", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0267" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0268", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0268" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0270", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0270" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0271", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0271" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0274", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0275, and CVE-2017-0276.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0274" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0275", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, and CVE-2017-0276.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0275" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0276", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, and CVE-2017-0275.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0276" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5472", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "summary", "text": "Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5472" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5468", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "summary", "text": "Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5468" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2017-0199", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "summary", "text": "Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0199" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2005-1794", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "summary", "text": "Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1794" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5470", "cwe": { "id": "CWE-428", "name": "Unquoted Search Path or Element" }, "notes": [ { "category": "summary", "text": "An unquoted search path or element vulnerability has been identified, which may allow an authorized local user to execute arbitrary code and escalate their level of privileges.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5470" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5454", "cwe": { "id": "CWE-489", "name": "Active Debug Code" }, "notes": [ { "category": "summary", "text": "The ISP has a vulnerability where code debugging methods are enabled, which could allow an attacker to remotely execute arbitrary code during runtime.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5454" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5458", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5458" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5462", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "summary", "text": "Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5462" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5464", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "summary", "text": "Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5464" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2018-5466", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "summary", "text": "Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5466" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2011-3389", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3389" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2004-2761", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-2761" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2014-3566", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the \"POODLE\" issue.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 3.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] }, { "cve": "CVE-2016-2183", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2183" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Philips\u0027 evaluation of Operating System security patches is ongoing, and after appropriate testing, the patches and mitigating controls are posted on Philips\u0027 InCenter. ISP users are recommended to obtain available mitigating controls by accessing their InCenter account at this location: http://incenter.medical.philips.com", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "http://incenter.medical.philips.com" }, { "category": "mitigation", "details": "Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "mitigation", "details": "Philips\u0027 contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.usa.philips.com/healthcare/solutions/customer-service-solutions" }, { "category": "mitigation", "details": "Please see the Philips product security website for the latest security information for Philips products: https://www.philips.com/productsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.philips.com/productsecurity" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ] } ] }
gsd-2017-0143
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2017-0143", "description": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "id": "GSD-2017-0143", "references": [ "https://packetstormsecurity.com/files/cve/CVE-2017-0143" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2017-0143" ], "details": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "id": "GSD-2017-0143", "modified": "2023-12-13T01:20:59.653541Z", "schema_version": "1.4.0" } }, "namespaces": { "cisa.gov": { "cveID": "CVE-2017-0143", "dateAdded": "2021-11-03", "dueDate": "2022-05-03", "product": "SMBv1 server", "requiredAction": "Apply updates per vendor instructions.", "shortDescription": "The SMBv1 server allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "vendorProject": "Microsoft", "vulnerabilityName": "Microsoft Windows SMBv1 Remote Code Execution Vulnerability" }, "cve.org": { "CVE_data_meta": { "ASSIGNER": "secure@microsoft.com", "ID": "CVE-2017-0143", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Windows SMB", "version": { "version_data": [ { "version_value": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607" } ] } } ] }, "vendor_name": "Microsoft Corporation" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Remote Code Execution" } ] } ] }, "references": { "reference_data": [ { "name": "41891", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/41891/" }, { "name": "96703", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96703" }, { "name": "1037991", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037991" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf" }, { "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143" }, { "name": "41987", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/41987/" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf" }, { "name": "43970", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/43970/" }, { "name": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html" }, { "name": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secure@microsoft.com", "ID": "CVE-2017-0143" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-20" } ] } ] }, "references": { "reference_data": [ { "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143" }, { "name": "96703", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/96703" }, { "name": "1037991", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id/1037991" }, { "name": "41987", "refsource": "EXPLOIT-DB", "tags": [], "url": "https://www.exploit-db.com/exploits/41987/" }, { "name": "41891", "refsource": "EXPLOIT-DB", "tags": [], "url": "https://www.exploit-db.com/exploits/41891/" }, { "name": "43970", "refsource": "EXPLOIT-DB", "tags": [], "url": "https://www.exploit-db.com/exploits/43970/" }, { "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource": "MISC", "tags": [], "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource": "CONFIRM", "tags": [], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource": "CONFIRM", "tags": [], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf" }, { "name": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource": "MISC", "tags": [], "url": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html" }, { "name": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource": "MISC", "tags": [], "url": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 2.2, "impactScore": 5.9 } }, "lastModifiedDate": "2018-06-21T01:29Z", "publishedDate": "2017-03-17T00:59Z" } } }
ghsa-fqgw-29m3-pwh5
Vulnerability from github
Published
2022-05-14 03:17
Modified
2024-07-25 15:30
Severity ?
Details
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
{ "affected": [], "aliases": [ "CVE-2017-0143" ], "database_specific": { "cwe_ids": [ "CWE-20" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2017-03-17T00:59:00Z", "severity": "HIGH" }, "details": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "id": "GHSA-fqgw-29m3-pwh5", "modified": "2024-07-25T15:30:34Z", "published": "2022-05-14T03:17:16Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0143" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf" }, { "type": "WEB", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "type": "WEB", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143" }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/41891" }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/41987" }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/43970" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/96703" }, { "type": "WEB", "url": "http://www.securitytracker.com/id/1037991" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.