CVE-2021-27501

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-710

Affected software

Vendor	Product	Versions
Philips	Vue PACS	>= unspecified, <= 12.2.x.x
Philips	Vue MyVue	>= unspecified, <= 12.2.x.x
Philips	Vue Speech	>= unspecified, <= 12.2.x.x
Philips	Vue Motion	>= unspecified, <= 12.2.1.5

References

http://www.philips.com/productsecurityVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01Mitigation, Third Party Advisory, US Government Resource
http://www.philips.com/productsecurityVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-275027.8Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely larg CVE-2021-275034.8Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior t CVE-2021-275047.8Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger CVE-2021-275057.5mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.CVE-2021-275065.5The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing CVE-2021-275097.5In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code.CVE-2021-275138.8The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le CVE-2021-275149.8EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication CVE-2021-275155.3url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.CVE-2021-275167.5URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.CVE-2021-275176.1Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious CVE-2021-275196.1A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.