CVE-2017-9656

The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application, which contains PHI. CVSS v3 base score: 9.1, CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

CVSS v3 9.1 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.1^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.philips.com/productsecurity	Vendor Advisory
http://www.securityfocus.com/bid/100471	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-17-229-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:philips:dosewise:1.1.7.333:::::::*
	cpe:2.3:a:philips:dosewise:2.1.1.3069:::::::*

History

No history.

Information

Published : 2018-04-24 15:29

Updated : 2023-12-10 12:30

NVD link : CVE-2017-9656

Mitre link : CVE-2017-9656

CVE.ORG link : CVE-2017-9656

JSON object : View

Products Affected

philips

dosewise

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2017-9656", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2018-04-24T15:29:00.867", "references": [{"url": "http://www.philips.com/productsecurity", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/100471", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-229-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application, which contains PHI. CVSS v3 base score: 9.1, CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H."}, {"lang": "es", "value": "La base de datos del backend de la aplicaci\u00f3n Philips DoseWise Portal, en sus versiones 1.1.7.333 y 2.1.1.3069, emplea credenciales embebidas para una cuenta de la base de datos con privilegios que puede afectar a la confidencialidad, integridad y disponibilidad de la base de datos. Para que un atacante explote esta vulnerabilidad, primero necesita privilegios elevados para poder acceder a los archivos del sistema del backend de la aplicaci\u00f3n web que contienen las credenciales embebidas. Si se explota esta vulnerabilidad con \u00e9xito, un atacante remoto podr\u00eda obtener acceso a la base de datos de la aplicaci\u00f3n DWP, que contiene PHI. Puntuaci\u00f3n base de CVSS v3: 9.1, cadena de vector CVSS: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H."}], "lastModified": "2019-10-09T23:30:46.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:philips:dosewise:1.1.7.333:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80593A69-82A9-47D2-A64A-248018A0C59D"}, {"criteria": "cpe:2.3:a:philips:dosewise:2.1.1.3069:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE12F34E-51D6-4045-888A-5D702FE85B1F"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}