CVE-2023-40704

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1392

Affected software

Vendor	Product	Versions
Philips	Vue PACS	< 12.2.8.410
philips	vue_pacs	< 12.2.8.410

References

http://www.philips.com/productsecurityProduct
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01Third Party Advisory, US Government Resource
http://www.philips.com/productsecurityProduct
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01Third Party Advisory, US Government Resource

Timeline

Published: Jul 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-407055.4Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inje CVE-2023-407069.8There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brut CVE-2023-407077.5There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could CVE-2023-407085.3The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access CVE-2023-407097.5An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enable CVE-2023-40718.8Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption vi CVE-2023-407107.5An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller h CVE-2023-407117.5Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attacker CVE-2023-407126.5Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in CVE-2023-407148.8A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to es CVE-2023-407155.5A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to CVE-2023-407167.8An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester