CVE-2023-40704: Philips Vue PACS Use of Default Credentials

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-18 · updated 2026-06-17
Weakness: CWE-1392

Description

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

Affected products

Philips Vue PACS: before 12.2.8.410 — fixed in 12.2.8.410

How to fix

Upgrade to a fixed version: Philips Vue PACS 12.2.8.410. Check the vendor advisory for mitigations.

References

http://www.philips.com/productsecurity
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01
http://www.philips.com/productsecurity
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01

Get alerted when CVE-2023-40704 or the next vulnerability affects your stack