CVE-2022-0922
Assigner: icscert
Published: 2022-03-29T00:00:00
State: PUBLISHED
affected: product: e-Alert
vendor: Philips
versions: lessThan: 2.7
status: affected
version: All
versionType: custom
credits: value: External researcher Andrew Dedmon reported this vulnerability to Philips
datePublic: 2022-03-29T00:00:00
descriptions: value: The software does not perform any authentication for critical system functionality.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-306
description: CWE-306 Missing Authentication for Critical Function
type: CWE
source: advisory: ICSMA-22-088-01
discovery: EXTERNAL
title: ICSMA-22-088-01 Philips e-Alert
workarounds: value: Users should operate all Philips deployed and supported products within Philips authorized specifications, including physical and logical controls. Only authorized personnel should be permitted to access the network and the devices connected to it.

Users with questions about their specific e-Alert product should contact a Philips service support team or regional service support. Users can also reference the Philips advisory for more details.
x_generator: engine: Vulnogram 0.0.9