title: Philips Vue PACS
description: Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
problem types: CVE-707 - Improper Neutralization
affected:
{
product: Vue PACS
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue MyVue
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Speech
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Motion
vendor: Philips
versions:
lessThanOrEqual: 12.2.1.5, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
solutions: Philips has released the following plans to address these vulnerabilities:
Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter.
Philips will release Version 15 in Q1 / 2022 for PACS that remediates this issue and recommends contacting support.
Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact a Philips Sales representative or submit a quote request in the eService portal at: Login - eService (philips.com)
The Philips advisory is available. Please see the Philips product security website for the latest security information for Philips products.