Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the sess…

published 2018-03-20 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-17208

cvss: 6.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-18-025-01 updated 2018-01-25 cvss 6.7

Philips IntelliSpace Cardiovascular System Vulnerability

Phillips IntelliSpace Cardiovascular <= 2.3.0
affected: mitigation “Please see the Philips product security web site for the latest security information for Philips products: https://www.philips.com/productsecurity” philips.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.3	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	3.3	AV:L/AC:M/Au:N/C:P/I:P/A:N

Classification

Weakness

CWE-613 DEPRECATED: Insufficient Session Expiration

References

usa.philips.com /healthcare/about/customer-support/product-security
mitigation, vendor-advisory
ics-cert.us-cert.gov /advisories/ICSMA-18-025-01
mitigation, third-party-advisory, us-government-resource
securityfocus.com /bid/102847
vdb-entry, third-party-advisory

Sources

CVE List CVE-2018-5438
NVD CVE-2018-5438

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary