|
Philips reviewed the reported complaint requesting iscv design such that there is no direct connection required to database from thick client.Based on the results of the investigation, it was determined that the iscv thick client is granted direct access to the product database, so an authenticated user can operate on patient and system data outside the application and thereby bypass application-level authorization checks and application-level audit record creation, including performing bulk actions beyond their application-level authorization.This vulnerability was found outside of clinical use during security testing, however, if exploited, based on the nature of actions performed by the attacker, there is potential for data corruption.A risk assessment was performed and concluded that this defect could allow an attacker to gain unauthorized access to the iscv database or patient data, potentially resulting in iscv becoming unavailable or patient data being corrupted.Under certain specific circumstances, this issue could potentially lead to delayed diagnosis or misdiagnosis.Based on this information, this is determined as a reportable malfunction.
|