CVE-2021-27501 Details
Description
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
A vulnerability exists in Philips Vue PACS versions 12.2.x.x and prior, as well as in Vue MyVue, Vue Speech, and Vue Motion (through 12.2.1.5). The issue arises from the software not adhering to certain coding standards, which can create weaknesses or exacerbate existing vulnerabilities. This lack of proper coding practices has led to several specific vulnerabilities, including improper input validation, cleartext transmission of sensitive information, and cross-site scripting, among others. Successful exploitation could allow unauthorized access, data modification, or code execution, negatively impacting the system's overall integrity and availability.
Philips has released version 12.2.8.100 in Q1 2022 for PACS that addresses this vulnerability. Users should contact a Philips Sales representative or submit a quote request in the eService portal for assistance with this update.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 | CVE | MitigationThird Party AdvisoryUS Government Resource |
| http://www.philips.com/productsecurity | CVE | Vendor Advisory |
| https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 | [email protected] | MitigationThird Party AdvisoryUS Government Resource |
| http://www.philips.com/productsecurity | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-710 | Improper Adherence to Coding Standards | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| philips myvue | < 12.2.1.5 |
CPE
Remediation
| |
| philips speech | < 12.2.8.0 |
CPE
Remediation
| |
| philips vue motion | < 12.2.1.5 |
CPE
Remediation
| |
| philips vue pacs | < 12.2.8.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Apr 8, 2022 | Initial Analysis | [email protected] |