CVE-2023-40223: Philips Vue PACS Improper Privilege Management
Published Jul 18, 2024
·Updated
Philips Vue PACS does not properly assign, modify, track, or check actor privileges, creating an unintended sphere of control for that actor.
Affected Software
1 affected component
Philips Vue PACS<12.2.8.410
Remediation
Information
Philips recommends upgrading to the latest Vue PACS version 12.2.8.400* released in August 2023.
For managed services customers, new releases will be made available upon resource availability. Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact their local Philips Sales representative or submit a request in the Philips Informatics Support portal https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/www.informatics.support.philips.com/csm .
Refer to the Philips advisory http://www.philips.com/productsecurity for more details.
Event History
Jul 18, 2024
CVE Published
via MITRE·04:23 PM
Rejected
via MITRE·04:23 PM
Apr 9, 2025
Rejected
via MITRE·08:23 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-40223?
The severity of CVE-2023-40223 is categorized as critical due to the improper assignment of actor privileges.
2
How do I fix CVE-2023-40223?
To fix CVE-2023-40223, update your Philips Vue PACS software to version 12.2.8.410 or later.
3
Which versions of Philips Vue PACS are affected by CVE-2023-40223?
CVE-2023-40223 affects all versions of Philips Vue PACS prior to version 12.2.8.410.
4
What types of vulnerabilities does CVE-2023-40223 represent?
CVE-2023-40223 represents an authorization flaw that impacts actor privilege management.
5
Is there a workaround for CVE-2023-40223 pending a software update?
Currently, there are no known workarounds for CVE-2023-40223, and users should apply the update as soon as possible.