Severity: Low
CVSSv3: 5.3 [CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:W/RC:C] [PCI]
CVE-ID: CVE-2018-14799
CWE-ID:
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The vulnerability allows a local unauthenticated attacker to bypass security restrictions on the target system.
The weakness exists due to boundary error or format string when handling malicious input. A local attacker can supply specially crafted data and trigger memory corruption to access and modify settings on the device.
Philips plans an update to correct these issues in the release scheduled for mid-year 2019.
Philips has also provided the following information regarding an operating system that is no longer supported by the operating system manufacturer:
Philips offers the following additional mitigation advice:
PageWriter TC70: -
PageWriter TC50: -
PageWriter TC30: -
PageWriter TC20: -
PageWriter TC10: -
CPEhttps://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
Severity: Low
CVSSv3: 5.5 [CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:W/RC:C] [PCI]
CVE-ID: CVE-2018-14801
CWE-ID:
CWE-798 - Use of Hard-coded Credentials
The vulnerability allows a physical attacker with superuser privileges to bypass security restrictions on the target system.
The weakness exists due to use of hardcoded credentials. A physical attacker can enter the superuser password that can be used to access and modify all settings on the device, as well as to reset existing passwords.
Philips plans an update to correct these issues in the release scheduled for mid-year 2019.
Philips has also provided the following information regarding an operating system that is no longer supported by the operating system manufacturer:
Philips offers the following additional mitigation advice:
PageWriter TC70: -
PageWriter TC50: -
PageWriter TC30: -
PageWriter TC20: -
PageWriter TC10: -
CPEhttps://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.