CVE-2025-2230: Philips Intellispace Cardiovascular (ISCV) Improper Authentication
First published: Thu Mar 13 2025(Updated: )
A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Philips IntelliSpace Cardiovascular |
Remedy
Philips recommends the following mitigations: * Resolved in ISCV 5.2, which was released in September 2020. * Philips recommends users upgrade ISCV installed base to the latest ISCV version (at the time of this publication is 830089 – IntelliSpace Cardiovacular 8.0.0.0) * Please contact a local Philips sales (service) representative to learn how to engage this upgrade process. * For managed services users, new releases will be made available upon resource availability. Releases are subject to country-specific regulations. Refer to the Philips advisory https://www.philips.com/a-w/security/security-advisories.html for more details.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2230?
CVE-2025-2230 has a high severity rating due to its potential for exploitation through replay attacks and authentication bypass.
How do I fix CVE-2025-2230?
To fix CVE-2025-2230, apply the latest security patch provided by Philips for the Intellispace Cardiovascular software.
What are the impacts of CVE-2025-2230?
The impacts of CVE-2025-2230 include unauthorized access to systems and sensitive data due to the authentication bypass vulnerability.
Is CVE-2025-2230 being actively exploited?
As of now, there have been reports indicating that CVE-2025-2230 is being targeted by attackers for exploitation.
Who is affected by CVE-2025-2230?
Organizations using Philips Intellispace Cardiovascular software are specifically affected by CVE-2025-2230.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/source
- agent/author
- agent/tags
- agent/event
- vendor/philips
- canonical/philips intellispace cardiovascular