CVE-2021-26248mediumCWE-708

CVE-2021-26248: medium-severity vulnerability in Philips MRI 1.5T

Philips MRI 1.5T and 3T Incorrect Ownership Assignment

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
In short

Philips MRI machines (versions 5.3-5.8.1) have a security flaw that allows unauthorized people to access medical imaging resources they shouldn't be able to reach. This is dangerous because it could expose sensitive patient data or allow tampering with critical medical equipment.

Technical detail

CWE-708 vulnerability in Philips MRI 1.5T and 3T systems fails to properly enforce access control on medical imaging resources. An unauthorized actor can access restricted resources without proper authentication or authorization checks, potentially compromising patient data confidentiality and system integrity.

Summary generated and translated by AI from the official description.
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Philips · MRI 1.5TPhilips · MRI 3T
Related CVEs — Philips MRI 1.5T

In the same product, most dangerous first.

CVE-2021-26262MEDIUMPhilips MRI 1.5T and 3T Improper Access ControlEPSS 0.7%CVE-2021-42744MEDIUMPhilips MRI 1.5T and 3T Information ExposureEPSS 0.3%
References
https://us-cert.cisa.gov/ics/advisories/icsma-21-313-01https://www.usa.philips.com/healthcare/about/customer-support/product-security