CVE-2017-9656: Critical severity philips dosewise vulnerability
The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application, which contains PHI. CVSS v3 base score: 9.1, CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9656?
CVE-2017-9656 has been identified as a vulnerability that could impact the confidentiality, integrity, and availability of the backend database.
How do I fix CVE-2017-9656?
To remediate CVE-2017-9656, it is essential to update the Philips DoseWise Portal to a version that does not utilize hard-coded database credentials.
What versions of Philips DoseWise are affected by CVE-2017-9656?
CVE-2017-9656 affects Philips DoseWise Portal versions 1.1.7.333 and 2.1.1.3069.
What are the risks of exploiting CVE-2017-9656?
Exploitation of CVE-2017-9656 could allow an attacker to gain unauthorized access to the backend database, potentially compromising sensitive data.
Is there any workaround for CVE-2017-9656?
Currently, there are no documented workarounds for CVE-2017-9656 other than applying the appropriate software updates.