Vulnerability · Published Mar 23, 2022 · Assigned by icscert
CVE-2021-27456Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control
Low 2.4
In plain English
A low-severity security flaw in Gemini 16 Slice from Philips. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Philips | Gemini 16 Slice | 882300 |
| Philips | Gemini Dual | 882160 |
| Philips | Gemini GXL 10 Slice | 882400 |
| Philips | Gemini GXL 6 Slice | 882390 |
| Philips | Gemini GXL 16 Slice | 882410 |
| Philips | GEMINI LXL | 882412 |
| Philips | Gemini TF Ready | 882473 |
| Philips | Gemini TF 16 w/ TOF Performance | 882470 |
| Philips | Gemini TF 64 w/ TOF Performance | 882471 |
| Philips | Gemini TF Big Bore | 882476 |
| Philips | TruFlight Select PET/CT | 882438 |
Weakness: CWE-921 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.cisa.gov/uscert/ics/advisories/icsma-21-084-01 x_refsource_CONFIRM
- https://www.philips.com/productsecurity x_refsource_CONFIRM