Read the docs
TI-2018-03963 Aliases CVE-2018-5451GHSA-gh52-v677-5j69

Improper authentication in Philips Alice 6 System

Priority MEDIUM 47CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or the ability to execute arbitrary code.

Why it matters now

EPSS 0.02646 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PhilipsPhilips Alice 6 SystemVersion R8.0.2 or prior.—No fix listedCNA
  • Philips Alice 6 System VendorPhilips Affected Version R8.0.2 or prior. Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:philips:alice_6_firmware:*:*:*:*:*:*:*:*up to r8.0.2VulnerablePhilips
cpe:2.3:h:philips:alice_6:-:*:*:*:*:*:*:*not specified by NVDRunning onPhilips
  • cpe:2.3:o:philips:alice_6_firmware:*:*:*:*:*:*:*:* Versions up to r8.0.2 Vulnerable ·Philips
  • cpe:2.3:h:philips:alice_6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5451
  2. 2026-10-03 Alias added: GHSA-gh52-v677-5j69

References

Advisory 1

  • TI-2018-05407 In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption… CVSS 3.0CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences