CVE-2020-27298
Philips Interventional Workstations OS Command Injection
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.
Timeline
- CVE published
- Record last updated
Affected versions
- Philips Interventional Workspot
Release 1.3.2, Release 1.4.0, Release 1.4.1, Release 1.4.3, Release 1.4.5
- Philips Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live
Release 1.0
- Philips ViewForum
Release 6.3V1L10