VulnerabilityModified

CVE-2017-9656

CRITICAL 9.1EPSS 2.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application, which contains PHI. CVSS v3 base score: 9.1, CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

CVSS 3.0: 9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 2.23% probability · 83th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-798
Affected: philips/dosewise
Source: ics-cert@hq.dhs.gov

EPSS trend

EPSS 2.2% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://www.philips.com/productsecurityVendor Advisory
http://www.securityfocus.com/bid/100471Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-17-229-01Third Party Advisory, US Government Resource
http://www.philips.com/productsecurityVendor Advisory
http://www.securityfocus.com/bid/100471Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-17-229-01Third Party Advisory, US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.