CVE-2018-5438

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 20, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-54399.8A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to exCVE-2018-54409.8A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based COCVE-2018-54417.8An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard deviceCVE-2018-54429.8A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerabCVE-2018-54435.3A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does not properly sanitizCVE-2018-54455.3A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read access to files witCVE-2018-54464.9Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.CVE-2018-54479.8An Improper Input Validation issue was discovered in Nari PCS-9611 relay. An improper input validation vulnerability has been identified thaCVE-2018-54484.8Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker tCVE-2018-54496.5A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does CVE-2018-54519.8In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficienCVE-2018-54527.5A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWav
CVE-2018-5438: Medium severity, CVSS 6.3 | Vulnix