CVE-2018-14801

Description

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset existing passwords.

Weakness classification

• CWE-798: Use of Hard-coded Credentials

Primary references

• ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
• ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource, VDB Entry
• ics-cert@hq.dhs.gov — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory