Cyber Resilience

CVE-2023-40704

Medium

Published: 18 July 2024

Published
18 July 2024
Modified
09 April 2025
KEV Added
Patch
CVSS Score v4 5.7 CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0008 23.4th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-40704 is a medium-severity Use of Default Credentials (CWE-1392) vulnerability in Philips Vue Pacs. Its CVSS base score is 5.7 (Medium).

Operationally, ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system…

more

availability and data integrity.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

philips
vue pacs
≤ 12.2.8.410

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1392

Mandates replacement of default credentials during secure configuration and provisioning procedures.

addresses: CWE-1392

Policy requires changing or avoiding default credentials during system setup and operation.

addresses: CWE-1392

Unique identification requirement prevents use of default or shared credentials by organizational users.

addresses: CWE-1392

Changing default authenticators prior to first use prevents use of default credentials.

addresses: CWE-1392

Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.

addresses: CWE-1392

Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.

addresses: CWE-1392

Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.

addresses: CWE-1392

Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.

References