title: Philips Vue PACS Cleartext Transmission of Sensitive Information
description: Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
problem types: CWE-319: Cleartext Transmission of Sensitive Information
affected:
{
product: Vue PACS
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue MyVue
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Speech
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Motion
vendor: Philips
versions:
lessThanOrEqual: 12.2.1.5, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: Philips has released the following plans to address these vulnerabilities:
Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter.
Philips released Version 12.2.8.0 in May of 2021 for Speech to remediate this issue and recommends contacting support.
Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact a Philips Sales representative or submit a quote request in the eService portal at: Login - eService (philips.com)
The Philips advisory is available. Please see the Philips product security website for the latest security information for Philips products.