Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2018-8846: Philips e-Alert Unit may let malicious web page content
CVE-2018-8846 · published 8 years ago
Summary
The e-Alert Unit firmware (versions R2.1 and earlier) can place user‑supplied data into web pages without properly cleaning it. This could allow an attacker to inject harmful code that other users see when they view the device's web interface. Update the firmware to the latest version or apply the vendor's patch to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| philips | e-alert_firmware |
<= r2.1 cpe:2.3:o:philips:e-alert_firmware:*:*:*:*:*:*:*:* |
Original advisory text
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as ...
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then served to other users.
References
- http://www.securityfocus.com/bid/105194 Third Party Advisory VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 Mitigation Third Party Advisory US Government Resource
- https://www.usa.philips.com/healthcare/about/customer-support/product-security Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Sep 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-8846 · NVD
Track software like this
Free during beta