CVE-2023-40704 MEDIUM

CVE-2023-40704: Philips Vue PACS Use of Default Credentials

Vendor Philips

Product Vue PACS

Weakness CWE-1392

Published July 18, 2024

Last update August 27, 2025

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Adjacent

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.

Key dates

02Disclosure timeline

July 18, 2024 CVE published

August 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-40704 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1392.html

Related vulnerabilities

04Related CVE

CVE-2025-10542 Insecure Default Admin Credentials Enable Full Administrative Access in iMonitor EAM CVE-2025-7740 Use of default credentials vulnerability in Hitachi Energy SuprOS product CVE-2026-7365 IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation CVE-2025-36221 Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops. CVE-2025-7907 yangzongzhuan RuoYi Druid application-druid.yml default credentials