CVE-2021-33018 : Security Advisory and Response

Philips Vue PACS versions 12.2.x.x and prior are affected by a vulnerability related to the use of a broken or risky cryptographic algorithm. This could lead to the exposure of sensitive information with a high severity impact in various areas. Philips has provided solutions to address this issue.

Understanding CVE-2021-33018

This vulnerability affects multiple products under the Philips brand, including Vue PACS, Vue MyVue, Vue Speech, and Vue Motion. The vulnerability was reported to CISA by Philips.

What is CVE-2021-33018?

The vulnerability stems from the use of an insecure cryptographic algorithm in Philips Vue PACS software versions 12.2.x.x and older. This flaw poses a significant risk of exposing critical data due to the insecure nature of the algorithm.

The Impact of CVE-2021-33018

With a CVSS base score of 7.5 out of 10, this vulnerability has a high severity impact on confidentiality, integrity, and availability. The attack complexity is high, requiring no user privileges but user interaction to exploit the vulnerability.

Technical Details of CVE-2021-33018

Vulnerability Description

The vulnerability arises from the use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and earlier, posing a serious risk to sensitive data.

Affected Systems and Versions

Vue PACS versions 12.2.x.x and prior, including Vue MyVue, Vue Speech, and Vue Motion, are confirmed to be affected by this vulnerability.

Exploitation Mechanism

This vulnerability, which has a high complexity and requires network access, could result in a successful attack that exposes sensitive information without needing any user privileges.

Mitigation and Prevention

To address CVE-2021-33018, Philips has provided the following solutions:

Configuring the Vue PACS environment as per the provided guide.
Releasing Version 15 in Q1/2022 for Speech and PACS to fix the issue.
Users are advised to contact support for further assistance and check the Philips product security website for the latest information.

Immediate Steps to Take

Users of affected systems should follow Philips' recommended configurations and apply patches as soon as they become available to mitigate the risk associated with this vulnerability.

Long-Term Security Practices

It is crucial for organizations to stay informed about security updates from Philips and regularly update their systems to protect against potential vulnerabilities.

Patching and Updates

Philips is actively working on releasing Version 15 in Q1/2022 to address this vulnerability. Users should stay informed about the release schedule and promptly apply these patches.