What is the CVSS score of CVE-2018-14801?

CVE-2018-14801 has a CVSS 3.0 base score of 6.2 (Medium). CVSS vector: CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Pagewriter Tc70 Firmware CVE-2018-14801

MEDIUM

Use of Hard-coded Credentials (CWE-798)

2018-08-22 ics-cert@hq.dhs.gov

Authentication Bypass Pagewriter Tc70 Firmware Pagewriter Tc50 Firmware Pagewriter Tc30 Firmware Pagewriter Tc20 Firmware Pagewriter Tc10 Firmware

6.2

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 22, 2018 - 18:29 nvd

MEDIUM 6.2

DescriptionNVD

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset existing passwords.

AnalysisAI

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that. Rated medium severity (CVSS 6.2), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset existing passwords. Affected products include: Philips Pagewriter Tc70 Firmware, Philips Pagewriter Tc50 Firmware, Philips Pagewriter Tc30 Firmware, Philips Pagewriter Tc20 Firmware, Philips Pagewriter Tc10 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.