« Volver al listado

CVE-2013-2808

Estado: ModificadaAlta (9.3)—

Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components, Xper Information Management Vascular Monitoring 5 components, and Xper Information Management servers and workstations for Flex Cardio products before XperConnect 1.5.4.053 SP2 allows remote attackers to execute arbitrary code via a crafted HTTP request to the Connect broker on TCP port 6000.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Philips — Xper Flex CardioPhilips — Xper Information Management Physiomonitoring 5Philips — Xper Information Management Vascular Monitoring 5Philips — Xperconnect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-2808",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-10-05T10:55:03.463",
  "references": [
    {
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-277-01",
      "tags": [
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-277-01",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components, Xper Information Management Vascular Monitoring 5 components, and Xper Information Management servers and workstations for Flex Cardio products before XperConnect 1.5.4.053 SP2 allows remote attackers to execute arbitrary code via a crafted HTTP request to the Connect broker on TCP port 6000."
    },
    {
      "lang": "es",
      "value": "Desobrdamiento de búffer basado en memoria dinámica de componentes Xper en Philips Xper Information Management Physiomonitoring 5, componentes Xper Information Management Vascular Monitoring 5, y servidores y estaciones de trabajo Xper Information Management para productos Flex Cardio anterior a XperConnect 1.5.4.053 SP2 permite a atacantes remotos ejecutar código arbitrario a través de peticiones HTTP manipuladas al broker Connect en el puerto 6000 de TCP."
    }
  ],
  "lastModified": "2026-06-16T23:53:59.983",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:xper_information_management_physiomonitoring_5:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "158B1CFF-F9DD-4CBB-96C6-2E5C25973CE3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:xperconnect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1099FA48-D9A6-404A-851C-558D54C6D1D9",
              "versionEndIncluding": "1.5.4.053"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:xper_information_management_vascular_monitoring_5:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BBD6C19-D046-4DA6-B1BB-1CAABBBAD04E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:xperconnect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1099FA48-D9A6-404A-851C-558D54C6D1D9",
              "versionEndIncluding": "1.5.4.053"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:philips:xper_flex_cardio:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "875CF337-C0CA-4D76-AC02-B992241AE978"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:xperconnect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1099FA48-D9A6-404A-851C-558D54C6D1D9",
              "versionEndIncluding": "1.5.4.053"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}