title: Philips Vue PACS Use of a Key Past its Expiration Date
description: Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
problem types: CWE-324: Use of a Key Past its Expiration Date
affected:
{
product: Vue PACS
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue MyVue
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Speech
vendor: Philips
versions:
lessThanOrEqual: 12.2.x.x, status: affected, version: unspecified, versionType: custom
}
{
product: Vue Motion
vendor: Philips
versions:
lessThanOrEqual: 12.2.1.5, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
]
solutions: Philips has released the following plans to address these vulnerabilities:
Philips recommends configuring the Vue PACS environment per D000763414 – Vue_PACS_12_Ports_Protocols_Services_Guide available on Incenter.
Philips released Version 12.2.1.5 in June of 2020 for Vue Motion to remediate this issue and recommends contacting support.
Releases are subject to country specific regulations. Users with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact a Philips Sales representative or submit a quote request in the eService portal at: Login - eService (philips.com)
The Philips advisory is available. Please see the Philips product security website for the latest security information for Philips products.