CVE-2023-40704: Philips Vue PACS Use of Default Credentials

Q: What is the severity of CVE-2023-40704?

CVE-2023-40704 is considered a critical vulnerability due to the use of default credentials in Philips Vue PACS.

Q: How do I fix CVE-2023-40704?

To fix CVE-2023-40704, replace the default credentials with strong, unique passwords for all accounts within Philips Vue PACS.

Q: Which versions of Philips Vue PACS are affected by CVE-2023-40704?

CVE-2023-40704 affects all versions of Philips Vue PACS up to and including version 12.2.8.410.

Q: What impact does CVE-2023-40704 have on Philips Vue PACS?

CVE-2023-40704 allows unauthorized access to potentially critical functionality within Philips Vue PACS due to default credential usage.

Q: Is there a way to check if my Philips Vue PACS is vulnerable to CVE-2023-40704?

To check for CVE-2023-40704 vulnerabilities, review the authentication settings for default credentials in your Philips Vue PACS installation.

Published Jul 18, 2024

Updated

Philips Vue PACS uses default credentials for potentially critical functionality.

Other sources

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

— MITRE

Affected Software

1 affected component

Philips Vue PACS<12.2.8.410

Remediation

Information

Philips recommends the following mitigations: * For CVE-2021-28165, Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter https://incenter.medical.philips.com/Default.aspx . Vue PACS version 12.2.8.410* released in October 2023 prevents this vulnerability. * For CVE-2023-40704, Philips recommends no action needed due to low risk of exploitability, but customers can request that Philips update database password(s). For managed services users, new releases will be made available upon resource availability. Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact their local Philips sales representative or submit a request in the Philips Informatics Support portal https://www.informatics.support.philips.com/csm . Refer to the Philips advisory https://www.philips.com/productsecurity for more details.

Event History

Jul 18, 2024

CVE Published

via MITRE·04:33 PM

Data Sourced

via MITRE·04:33 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-40704?

CVE-2023-40704 is considered a critical vulnerability due to the use of default credentials in Philips Vue PACS.

How do I fix CVE-2023-40704?

To fix CVE-2023-40704, replace the default credentials with strong, unique passwords for all accounts within Philips Vue PACS.

Which versions of Philips Vue PACS are affected by CVE-2023-40704?