CVE-2023-40704

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.philips.com/productsecurity	Product
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01	Third Party Advisory US Government Resource
http://www.philips.com/productsecurity	Product
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:*

History

09 Apr 2025, 21:16

Type	Values Removed	Values Added
Summary	~~(en) Philips Vue PACS uses default credentials for potentially critical functionality.~~	(en) The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.
CVSS	v2 : ~~unknown~~ v3 : ~~7.1~~	v2 : unknown v3 : 6.8

21 Nov 2024, 08:19

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : 7.1
References	~~() http://www.philips.com/productsecurity - Product~~	() http://www.philips.com/productsecurity - Product
References	~~() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01 - Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01 - Third Party Advisory, US Government Resource

05 Sep 2024, 21:01

Type	Values Removed	Values Added
References	~~() http://www.philips.com/productsecurity -~~	() http://www.philips.com/productsecurity - Product
References	~~() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01 -~~	() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01 - Third Party Advisory, US Government Resource
First Time		Philips Philips vue Pacs
CPE		cpe:2.3:a:philips:vue_pacs::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~7.1~~	v2 : unknown v3 : 9.8
CWE		NVD-CWE-Other

19 Jul 2024, 13:01

Type	Values Removed	Values Added
Summary		(es) Philips Vue PACS utiliza credenciales predeterminadas para funciones potencialmente críticas.

18 Jul 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-18 17:15

Updated : 2025-04-09 21:16

NVD link : CVE-2023-40704

Mitre link : CVE-2023-40704

CVE.ORG link : CVE-2023-40704

JSON object : View

Products Affected

philips

vue_pacs

CWE

CWE-1392

Use of Default Credentials

NVD-CWE-Other

{"id": "CVE-2023-40704", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-07-18T17:15:03.897", "references": [{"url": "http://www.philips.com/productsecurity", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.philips.com/productsecurity", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-1392"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The product does not require unique and complex passwords to be created \nduring installation. Using Philips's default password could jeopardize \nthe PACS system if the password was hacked or leaked. An attacker could \ngain access to the database impacting system availability and data \nintegrity."}, {"lang": "es", "value": "Philips Vue PACS utiliza credenciales predeterminadas para funciones potencialmente cr\u00edticas."}], "lastModified": "2025-04-09T21:16:24.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3D16037-0684-4486-80A7-8EE98DD4E851", "versionEndExcluding": "12.2.8.410"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}

6.8 /10