|
Philips identified an internal software defect in the intellispace cardiovascular (iscv) system whereby server message block (smb) signing is not mandatorily enforced on remote hosts.There is no allegation of death, serious injury, or adverse event associated with this issue.This security weakness could allow an attacker with prior access to the iscv network to intercept or manipulate communications between systems, potentially leading to unauthorized access to sensitive patient information (phi/pii), modification of image repository files, or other unauthorized file operations.Under certain circumstances, compromised medical images or patient data could be relied upon for clinical decision-making, potentially resulting in misdiagnosis, delayed or missed critical findings.Therefore, although the issue was identified internally and exploitation requires prior network access, the potential impact on the integrity of diagnostic information and subsequent clinical decision-making supports classification of this issue as a reportable malfunction.
|