In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize da…

Published 8 y ago 2018-08-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.7

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.5%

percentile 43%

Public exploits

none known

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities.

Exploit prediction (EPSS)

0.50% probability of exploitation in the next 30 days, higher than 43% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	3.7	`CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L`
NVD	2.0	4.6	`AV:L/AC:L/Au:N/C:P/I:P/A:P`

Affected products

Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs

Classification

Weakness

CWE-20 Improper Input Validation
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-134 Use of Externally-Controlled Format String

References

ics-cert.us-cert.gov /advisories/ICSMA-18-228-01 · x_refsource_MISC, x_transferred
usa.philips.com /healthcare/about/customer-support/product-security · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/105103 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2018-14799
NVD: CVE-2018-14799

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.