Security readout for executives and security teams
Plain-English summary
This vulnerability affects specific Philips interventional and imaging workstation software. An attacker on an adjacent network path could influence input that becomes part of an operating-system command, potentially causing a serious availability impact. The source bundle does not show confirmed active exploitation.
Executive priority
Treat this as a moderate medical-technology availability risk. Prioritize asset identification and vendor-guided remediation, especially where affected systems support active clinical workflows or are broadly reachable inside hospital networks.
Technical view
CVE-2020-27298 is CWE-78 OS command injection in listed Philips Interventional Workspot, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, and ViewForum releases. CVSS 3.1 is 6.5, with adjacent-network access, low complexity, no privileges, no user interaction, and high availability impact only.
Likely exposure
Exposure is most likely in healthcare environments running the named Philips releases on connected clinical or imaging networks. The CVSS vector indicates adjacent-network reachability, not general internet exposure.
Exploitation context
The bundle marks CISA KEV as false and provides no cited evidence of active exploitation. Risk is driven by potential service disruption to clinical workstation functions if an adjacent attacker can reach the vulnerable component path.
Researcher notes
Evidence is limited to the CVE description, CVSS vector, affected release list, CWE-78 classification, and public advisory references. Do not assume remote internet exploitability, code execution impact categories beyond the CVSS fields, or a specific patch path from this bundle alone.
Mitigation direction
- Confirm Philips' current remediation guidance for the listed releases.
- Contact Philips support before changing clinical workstation software or configuration.
- Apply only vendor-approved updates, replacements, or configuration changes.
- Limit adjacent-network access to affected systems where clinically feasible.
- Document temporary risk acceptance if remediation cannot be scheduled promptly.
Validation and detection
- Inventory Philips Interventional Workspot release versions in use.
- Check for Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live Release 1.0.
- Check for ViewForum Release 6.3V1L10.
- Verify affected systems are not reachable from unnecessary adjacent networks.
- Confirm whether vendor-approved remediation remains unapplied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-27298 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-21-019-01CVE reference · x_refsource_MISC
- https://www.philips.com/a-w/security/security-advisories/product-security-2021.html#2021_archiveCVE reference
- https://us-cert.cisa.gov/ics/advisories/icsma-21-019-01CVE reference · x_refsource_MISC, x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.