title: Philips Vue PACS Insufficiently Protected Credentials
description: Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.
problem types: CWE-522: Insufficiently Protected Credentials
affected:
{
product: Vue PACS
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue MyVue
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Speech
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Motion
vendor: Philips
versions:
lessThanOrEqual: 12.2.1.5, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: Philips has released the following plans to address these vulnerabilities:
Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter.
Philips will release Version 15 in Q1 / 2022 for PACS to remediate this issue and recommends contacting support.
Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact a Philips Sales representative or submit a quote request in the eService portal at: Login - eService (philips.com)
The Philips advisory is available. Please see the Philips product security website for the latest security information for Philips products.