Details of VAR-201912-0998

ID

VAR-201912-0998

CVE

CVE-2019-18263

TITLE

plural Philips Vulnerability regarding encryption strength in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-014020

DESCRIPTION

An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 2018), Veradius Unity (718132) with ViewForum option (shipped between 2016-August 2018), Pulsera (718095) and Endura (718075) with wireless option (shipped between 26-June-2017 through 07-August 2018), Pulsera (718095) and Endura (718075) with ViewForum option (shipped between 26-June-2017 through 07-August 2018). The router software uses an encryption scheme that is not strong enough for the level of protection required. Philips Veradius Unity , Pulsera , Endura Dual WAN The router contains a cryptographic strength vulnerability.Denial of service (DoS) May be in a state. Philips Veradius Unity and others are European C-arm devices for the medical industry from Philips. The vulnerability stems from the use of a weak encryption mechanism in the program. Attackers can use this vulnerability to invade the management interface of the front-end router and affect the availability of data transmission

Trust: 2.34

sources: NVD: CVE-2019-18263 // JVNDB: JVNDB-2019-014020 // CNVD: CNVD-2020-01008 // IVD: a7a052ae-a64c-4ab2-8b87-0cdce6cda445

IOT TAXONOMY

category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: a7a052ae-a64c-4ab2-8b87-0cdce6cda445 // CNVD: CNVD-2020-01008

AFFECTED PRODUCTS

vendor:	philips	model:	pulsera	scope:	eq	version:	-	Trust: 2.2
vendor:	philips	model:	veradius unity	scope:	eq	version:	-	Trust: 2.2
vendor:	philips	model:	endura	scope:	eq	version:	-	Trust: 2.2
vendor:	phillips	model:	endura	scope:	eq	version:	718075	Trust: 0.8
vendor:	phillips	model:	pulsera	scope:	eq	version:	718095	Trust: 0.8
vendor:	phillips	model:	veradius unity	scope:	eq	version:	718132	Trust: 0.8
vendor:	philips	model:	endura	scope:	-	version:	-	Trust: 0.6
vendor:	philips	model:	pulsera	scope:	-	version:	-	Trust: 0.6
vendor:	philips	model:	veradius unity	scope:	-	version:	-	Trust: 0.6
vendor:	veradius unity	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	pulsera	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	endura	model:	-	scope:	eq	version:	-	Trust: 0.2

sources: IVD: a7a052ae-a64c-4ab2-8b87-0cdce6cda445 // CNVD: CNVD-2020-01008 // JVNDB: JVNDB-2019-014020 // CNNVD: CNNVD-201912-935 // NVD: CVE-2019-18263

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-18263
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-18263
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-01008
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201912-935
value:	MEDIUM
Trust: 0.6
IVD:	a7a052ae-a64c-4ab2-8b87-0cdce6cda445
value:	MEDIUM
Trust: 0.2

nvd@nist.gov:	CVE-2019-18263
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-01008
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:A/AC:H/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.2
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	a7a052ae-a64c-4ab2-8b87-0cdce6cda445
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:A/AC:H/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.2
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2019-18263
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2019-18263
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: a7a052ae-a64c-4ab2-8b87-0cdce6cda445 // CNVD: CNVD-2020-01008 // JVNDB: JVNDB-2019-014020 // CNNVD: CNNVD-201912-935 // NVD: CVE-2019-18263

PROBLEMTYPE DATA

problemtype:

CWE-326

Trust: 1.8

sources: JVNDB: JVNDB-2019-014020 // NVD: CVE-2019-18263

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201912-935

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201912-935

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-014020

PATCH

title:	Top Page	url:	https://www.usa.philips.com/	Trust: 0.8
title:	Patch for Vulnerability in multiple Philips products	url:	https://www.cnvd.org.cn/patchInfo/show/196403	Trust: 0.6
title:	Multiple Philips Product encryption problem vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=105681	Trust: 0.6

sources: CNVD: CNVD-2020-01008 // JVNDB: JVNDB-2019-014020 // CNNVD: CNNVD-201912-935

EXTERNAL IDS

db:	NVD	id:	CVE-2019-18263	Trust: 3.2
db:	ICS CERT	id:	ICSMA-19-353-01	Trust: 3.0
db:	CNVD	id:	CNVD-2020-01008	Trust: 0.8
db:	CNNVD	id:	CNNVD-201912-935	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-014020	Trust: 0.8
db:	AUSCERT	id:	ESB-2019.4724	Trust: 0.6
db:	IVD	id:	A7A052AE-A64C-4AB2-8B87-0CDCE6CDA445	Trust: 0.2

sources: IVD: a7a052ae-a64c-4ab2-8b87-0cdce6cda445 // CNVD: CNVD-2020-01008 // JVNDB: JVNDB-2019-014020 // CNNVD: CNNVD-201912-935 // NVD: CVE-2019-18263

REFERENCES

url:	https://www.us-cert.gov/ics/advisories/icsma-19-353-01	Trust: 3.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-18263	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-18263	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2019.4724/	Trust: 0.6

sources: CNVD: CNVD-2020-01008 // JVNDB: JVNDB-2019-014020 // CNNVD: CNNVD-201912-935 // NVD: CVE-2019-18263

SOURCES

db:	IVD	id:	a7a052ae-a64c-4ab2-8b87-0cdce6cda445
db:	CNVD	id:	CNVD-2020-01008
db:	JVNDB	id:	JVNDB-2019-014020
db:	CNNVD	id:	CNNVD-201912-935
db:	NVD	id:	CVE-2019-18263

LAST UPDATE DATE

2024-11-23T22:29:49.532000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-01008	date:	2020-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-014020	date:	2020-01-24T00:00:00
db:	CNNVD	id:	CNNVD-201912-935	date:	2020-01-17T00:00:00
db:	NVD	id:	CVE-2019-18263	date:	2024-11-21T04:32:56.343

SOURCES RELEASE DATE

db:	IVD	id:	a7a052ae-a64c-4ab2-8b87-0cdce6cda445	date:	2020-01-08T00:00:00
db:	CNVD	id:	CNVD-2020-01008	date:	2020-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-014020	date:	2020-01-24T00:00:00
db:	CNNVD	id:	CNNVD-201912-935	date:	2019-12-19T00:00:00
db:	NVD	id:	CVE-2019-18263	date:	2019-12-20T16:15:11.577