{"id":"CVE-2025-2230","state":"PUBLISHED","title":"Philips Intellispace Cardiovascular (ISCV) Improper Authentication","description":"A flaw exists in the Windows login flow where an AuthContext token can \nbe exploited for replay attacks and authentication bypass.","publishedAt":"2025-03-13T18:14:43.573Z","updatedAt":"2025-03-17T20:05:56.939Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Philips Intellispace Cardiovascular (ISCV)"],"affected":[{"vendor":"Philips","product":"Intellispace Cardiovascular (ISCV)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.1","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-072-01","https://www.philips.com/a-w/security/security-advisories.html"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2230.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2230","state":"PUBLISHED","datePublished":"2025-03-13T18:14:43.573Z","dateUpdated":"2025-03-17T20:05:56.939Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-03-11T20:14:50.017Z"},"containers":{"cna":{"title":"Philips Intellispace Cardiovascular (ISCV) Improper Authentication","descriptions":[{"lang":"en","value":"A flaw exists in the Windows login flow where an AuthContext token can \nbe exploited for replay attacks and authentication bypass."}],"affected":[{"vendor":"Philips","product":"Intellispace Cardiovascular (ISCV)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.1","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-072-01"},{"url":"https://www.philips.com/a-w/security/security-advisories.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-03-17T20:05:56.939Z"},"credits":[{"lang":"en","type":"finder","value":"Joe Dillon reported these vulnerabilities to Philips."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
Philips recommends the following mitigations:
\n
\n
\n\nResolved in ISCV 5.2, which was released in September 2020.\n\n
\n\n
Philips recommends users upgrade ISCV installed base to the latest \nISCV version (at the time of this publication is 830089 – IntelliSpace \nCardiovacular 8.0.0.0)
\n
Please contact a local Philips sales (service) representative to learn how to engage this upgrade process.
\n
For managed services users, new releases will be made available upon\n resource availability. Releases are subject to country-specific \nregulations.
"}],"value":"Philips recommends the following mitigations:\n\n\n\n * \n\nResolved in ISCV 5.2, which was released in September 2020.\n\n\n\n\n * Philips recommends users upgrade ISCV installed base to the latest \nISCV version (at the time of this publication is 830089 – IntelliSpace \nCardiovacular 8.0.0.0)\n\n * Please contact a local Philips sales (service) representative to learn how to engage this upgrade process.\n\n * For managed services users, new releases will be made available upon\n resource availability. Releases are subject to country-specific \nregulations.\n\n\n\n\nRefer to the Philips advisory https://www.philips.com/a-w/security/security-advisories.html for more details."}],"source":{"advisory":"ICSMA-25-072-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-13T19:33:45.514056Z","id":"CVE-2025-2230","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-13T19:34:02.967Z"}}]}}}