vulnwire
9.8crit

CVE-2018-8850

Philips e-Alert Unit (non-medical device), Version R2.1 and prior.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.8%
percentile 90%
Public exploits
0
none known

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a form that is not expected by the rest of the application. This would lead to parts of the unit receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution.

Exploit prediction (EPSS)

3.83% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Philips e-Alert Unit (non-medical device)

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • usa.philips.com /healthcare/about/customer-support/product-security · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/105194 · vdb-entry, x_refsource_BID, x_transferred
  • ics-cert.us-cert.gov /advisories/ICSA-18-242-01 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.