What’s Vulnerable › Vulnerabilities

CVE-2020-27298: Philips Interventional Workstations OS Command Injection

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-26 · updated 2026-06-17
• Weakness: CWE-78

Description

Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.

Affected products

• Philips Coronary Tools: 1.0
• Philips Dynamic Coronary Roadmap: 1.0
• Philips Interventional Workspot: 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5
• Philips Stentboost Live: 1.0
• Philips ViewForum: 6.3v1l10

References

• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-21-019-01
• https://www.philips.com/a-w/security/security-advisories/product-security-2021.html#2021_archive
• https://us-cert.cisa.gov/ics/advisories/icsma-21-019-01

Get alerted when CVE-2020-27298 or the next vulnerability affects your stack