Vulnerability

Philips Vue PACS before 12.2.8.410 ships a default database password and can be overloaded

MedDevice Cyber Staff · Jul 18 · 3 min read · Via CISA ICSMA-24-200-01

CISA published advisory ICSMA-24-200-01 on July 18, 2024, covering Philips Vue PACS versions before 12.2.8.410. TAS Health NZ and Camiel van Es are credited. CISA notes the vulnerabilities are not exploitable remotely and no known public exploitation had been reported.

CVE-2023-40704 (CWE-1392, CVSS v3 6.8) is the more serious. The product does not require unique and complex passwords at installation, so a site running Philips's default password is one leak away from an attacker reaching the database, with impact on availability and data integrity. The vector requires adjacent access and high privileges.

CVE-2021-28165 (CWE-770, 6.5) is resource exhaustion: an attacker on the hospital's private network sends numerous requests or large amounts of data until the application crashes or stops responding. Philips says it does not expose or modify patient data.

Version 12.2.8.410, released in October 2023, prevents CVE-2021-28165, and Philips also points to its Vue PACS 12 Ports, Protocols and Services Guide on InCenter. For CVE-2023-40704 Philips recommends no action because of low exploitability, though customers can ask Philips to change the database passwords. Ask. A default database password on an image archive belongs to everyone who has ever installed one.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade Philips Vue PACS to 12.2.8.410 or later, released October 2023, which prevents CVE-2021-28165, and configure it per the Vue PACS 12 Ports, Protocols and Services Guide. For CVE-2023-40704, ask Philips to replace the default database password(s). Managed services customers should contact their Philips representative or the Informatics Support portal for release eligibility.

Upgrade to 12.2.8.410. Move every Vue PACS installation to version 12.2.8.410 or later.
Replace default database passwords. Request that Philips update the database password(s) rather than relying on its low-risk assessment.
Apply the ports and services guide. Configure the environment per Philips's Vue PACS 12 Ports, Protocols and Services Guide on InCenter.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts Patient or study database

Contributing

DICOM or image parsing Hospital network

Vue PACS

PID-3321 Patient or study database Hospital network

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management System	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2023-40704 in Philips Vue PACS?

CVE-2023-40704 means Philips Vue PACS before 12.2.8.410 does not require unique and complex passwords during installation, so the default database password could let an attacker reach the database. CISA advisory ICSMA-24-200-01, published July 18, 2024, scores it 6.8 under CVSS v3.

Which Philips Vue PACS version fixes CVE-2021-28165?

Philips Vue PACS version 12.2.8.410, released in October 2023, prevents CVE-2021-28165, per CISA advisory ICSMA-24-200-01. Philips also recommends configuring the environment per its Vue PACS 12 Ports, Protocols and Services Guide on InCenter.

← Back to Vulnerabilities