« Volver al listado

CVE-2021-27493

Estado: ModificadaMedia (6.5)—

Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Philips — MyvuePhilips — SpeechPhilips — VUE MotionPhilips — VUE Pacs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27493",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-27493",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-17T14:30:25.220064Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Philips",
          "product": "Vue PACS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.x.x"
            }
          ]
        },
        {
          "vendor": "Philips",
          "product": "Vue MyVue",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.x.x"
            }
          ]
        },
        {
          "vendor": "Philips",
          "product": "Vue Speech",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.x.x"
            }
          ]
        },
        {
          "vendor": "Philips",
          "product": "Vue Motion",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.1.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-01T23:15:09.207",
  "references": [
    {
      "url": "http://www.philips.com/productsecurity",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.philips.com/productsecurity",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-707"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component."
    },
    {
      "lang": "es",
      "value": "Philips Vue PACS versiones 12.2.x.x y anteriores, no asegura o asegura incorrectamente que los mensajes o datos estructurados estén bien formados y que sean cumplidas determinadas propiedades de seguridad antes de ser leídos desde un componente ascendente o enviados a un componente descendente"
    }
  ],
  "lastModified": "2026-06-17T03:44:58.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:myvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "318C7D67-5A69-46FE-91D6-46D970BD04CC",
              "versionEndExcluding": "12.2.1.5"
            },
            {
              "criteria": "cpe:2.3:a:philips:speech:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E491B68-B518-443D-95A5-56C14759C047",
              "versionEndExcluding": "12.2.8.0"
            },
            {
              "criteria": "cpe:2.3:a:philips:vue_motion:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DCDCF9C-D950-42E1-8827-76E12F3F280F",
              "versionEndExcluding": "12.2.1.5"
            },
            {
              "criteria": "cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DD47316-BA3D-4819-90F9-75B41292A154",
              "versionEndExcluding": "12.2.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}