Security readout for executives and security teams
Plain-English summary
CVE-2021-39376 is a reported SQL injection issue in Philips Healthcare Tasy EMR 3.06. For healthcare organizations, the concern is unauthorized database interaction through an EMR workflow, but the public record provides no CVSS score and limited affected-version detail.
Executive priority
Prioritize investigation if Philips Tasy EMR 3.06 is in use, especially in clinical or patient-data environments. The vulnerability class is serious, but public severity and exploitation evidence are incomplete.
Technical view
The CVE description names SQL injection in CorCad_F2/executaConsultaEspecifico through the IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter. The source bundle identifies Tasy EMR 3.06, but the structured affected-product fields are incomplete.
Likely exposure
Likely exposure is limited to environments running Philips Healthcare Tasy EMR 3.06 where the named application path is reachable. Public data does not establish broader version impact, internet exposure, authentication requirements, or appliance/cloud deployment scope.
Exploitation context
A public vulnerability write-up exists, but the source bundle does not show CISA KEV listing or any cited evidence of active exploitation. Treat exploit status as publicly disclosed, not confirmed exploited in the wild.
Researcher notes
The main evidence names two injectable parameters and one endpoint. Missing CVSS, CWE, complete affected CPEs, and vendor remediation details reduce certainty. Do not assume other Tasy versions are affected without vendor confirmation.
Mitigation direction
- Check Philips guidance for supported fixes or upgrade paths.
- Restrict network access to Tasy EMR administration and application paths.
- Review WAF or database controls for SQL injection protections.
- Prioritize remediation where EMR contains patient or billing data.
- Escalate to the vendor if running Tasy EMR 3.06.
Validation and detection
- Inventory whether Philips Tasy EMR 3.06 is deployed.
- Confirm whether CorCad_F2/executaConsultaEspecifico is reachable.
- Review logs for unusual requests to the named parameters.
- Check vendor advisories before performing vulnerability testing.
- Validate compensating controls with approved defensive testing only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-39376 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://diesec.home.blog/2021/08/24/philips-tasy-emr-3-06-sql-injection-cve-2021-39375cve-2021-39376/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.