« Volver al listado

CVE-2021-33018

Estado: ModificadaAlta (7.5)—

The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Philips — MyvuePhilips — SpeechPhilips — VUE MotionPhilips — VUE Pacs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-33018",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-33018",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-16T17:30:33.250501Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Philips",
          "product": "Vue PACS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.x.x"
            }
          ]
        },
        {
          "vendor": "Philips",
          "product": "Vue MyVue",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.x.x"
            }
          ]
        },
        {
          "vendor": "Philips",
          "product": "Vue Speech",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.x.x"
            }
          ]
        },
        {
          "vendor": "Philips",
          "product": "Vue Motion",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.1.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-01T23:15:10.137",
  "references": [
    {
      "url": "http://www.philips.com/productsecurity",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.philips.com/productsecurity",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information."
    },
    {
      "lang": "es",
      "value": "El uso de un algoritmo criptográfico roto o arriesgado en  Philips Vue PACS versiones 12.2.x.x y anteriores, es un riesgo innecesario que puede resultar en una exposición de información confidencial"
    }
  ],
  "lastModified": "2026-06-17T03:54:01.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:philips:myvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "318C7D67-5A69-46FE-91D6-46D970BD04CC",
              "versionEndExcluding": "12.2.1.5"
            },
            {
              "criteria": "cpe:2.3:a:philips:speech:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E491B68-B518-443D-95A5-56C14759C047",
              "versionEndExcluding": "12.2.8.0"
            },
            {
              "criteria": "cpe:2.3:a:philips:vue_motion:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DCDCF9C-D950-42E1-8827-76E12F3F280F",
              "versionEndExcluding": "12.2.1.5"
            },
            {
              "criteria": "cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DD47316-BA3D-4819-90F9-75B41292A154",
              "versionEndExcluding": "12.2.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}