Read the docs
TI-2023-21489 Aliases CVE-2023-40704GHSA-vh9f-gm3f-x483

Philips Vue PACS Use of Default Credentials

Priority LOW 28CWE-1392Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed Vue PACS (Philips): 12.2.8.410

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PhilipsVue PACSbefore 12.2.8.41012.2.8.410Patch availableCNA
  • Vue PACS VendorPhilips Affected before 12.2.8.410 Fixed in 12.2.8.410 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:*before 12.2.8.410VulnerablePhilips
  • cpe:2.3:a:philips:vue_pacs:*:*:*:*:*:*:*:* Versions before 12.2.8.410 Vulnerable ·Philips

Remediation

  • Fix · CNA Vue PACS (Philips) Fixed in 12.2.8.410

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40704
  2. 2026-10-03 Alias added: GHSA-vh9f-gm3f-x483

References

Advisory 1

Other 1

  • TI-2021-08986 Philips Vue PACS Improper Adherence to Coding Standards CVSS 3.1CRITICAL 9.8
  • TI-2021-08982 Philips Vue PACS Protection Mechanism Failure CVSS 3.1CRITICAL 9.8
  • TI-2021-12627 Philips Vue PACS Use of a Key Past its Expiration Date CVSS 3.1HIGH 8.2
  • TI-2021-12629 Philips Vue PACS Cleartext Transmission of Sensitive Information CVSS 3.1HIGH 7.5
  • TI-2021-12625 Philips Vue PACS Use of a Broken or Risky Cryptographic Algorithm CVSS 3.1HIGH 7.5
  • TI-2021-12631 Philips Vue PACS Insufficiently Protected Credentials CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences