Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The Philips e-Alert communication channel is not encrypted which could therefore lead to disclosure of personal contact information and application login credentials from within the same subnet.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/105194 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 | Mitigation Third Party Advisory US Government Resource |
| https://www.usa.philips.com/healthcare/about/customer-support/product-security | Vendor Advisory |
| http://www.securityfocus.com/bid/105194 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 | Mitigation Third Party Advisory US Government Resource |
| https://www.usa.philips.com/healthcare/about/customer-support/product-security | Vendor Advisory |
Configurations
History
21 Nov 2024, 04:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/105194 - Third Party Advisory, VDB Entry | |
| References | () https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 - Mitigation, Third Party Advisory, US Government Resource | |
| References | () https://www.usa.philips.com/healthcare/about/customer-support/product-security - Vendor Advisory |
Information
Published : 2018-09-26 19:29
Updated : 2024-11-21 04:14
NVD link : CVE-2018-8842
Mitre link : CVE-2018-8842
CVE.ORG link : CVE-2018-8842
JSON object : View
Products Affected
philips
- e-alert_firmware
CWE
CWE-319
Cleartext Transmission of Sensitive Information