CVE-2021-33020

Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

CVSS v3 8.2 HIGH
CVSS v2.0 5.0 MEDIUM

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.philips.com/productsecurity	Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01	Mitigation Third Party Advisory US Government Resource
http://www.philips.com/productsecurity	Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:philips:myvue::::::::
	cpe:2.3:a:philips:speech::::::::
	cpe:2.3:a:philips:vue_motion::::::::
	cpe:2.3:a:philips:vue_pacs::::::::

History

21 Nov 2024, 06:08

Type	Values Removed	Values Added
CVSS	v2 : ~~5.0~~ v3 : ~~7.5~~	v2 : 5.0 v3 : 8.2
References	~~() http://www.philips.com/productsecurity - Vendor Advisory~~	() http://www.philips.com/productsecurity - Vendor Advisory
References	~~() https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - Mitigation, Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - Mitigation, Third Party Advisory, US Government Resource

07 Jul 2023, 19:06

Type	Values Removed	Values Added
CWE	~~CWE-311~~	CWE-672

Information

Published : 2022-04-01 23:15

Updated : 2024-11-21 06:08

NVD link : CVE-2021-33020

Mitre link : CVE-2021-33020

CVE.ORG link : CVE-2021-33020

JSON object : View

Products Affected

philips

myvue
speech
vue_pacs
vue_motion

CWE

CWE-324

Use of a Key Past its Expiration Date

CWE-672

Operation on a Resource after Expiration or Release

{"id": "CVE-2021-33020", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-04-01T23:15:10.193", "references": [{"url": "http://www.philips.com/productsecurity", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.philips.com/productsecurity", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-324"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key."}, {"lang": "es", "value": "Philips Vue PACS versiones 12.2.x.x y anteriores, de usan una clave criptogr\u00e1fica o una contrase\u00f1a que ya ha caducado, lo que disminuye significativamente su seguridad al aumentar la ventana de tiempo para los ataques de cracking contra esa clave"}], "lastModified": "2024-11-21T06:08:08.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:philips:myvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "318C7D67-5A69-46FE-91D6-46D970BD04CC", "versionEndExcluding": "12.2.1.5"}, {"criteria": "cpe:2.3:a:philips:speech:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E491B68-B518-443D-95A5-56C14759C047", "versionEndExcluding": "12.2.8.0"}, {"criteria": "cpe:2.3:a:philips:vue_motion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DCDCF9C-D950-42E1-8827-76E12F3F280F", "versionEndExcluding": "12.2.1.5"}, {"criteria": "cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DD47316-BA3D-4819-90F9-75B41292A154", "versionEndExcluding": "12.2.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}