CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.

• CWE-613

• http://www.securityfocus.com/bid/102847Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01Mitigation, Third Party Advisory, US Government Resource
• https://www.usa.philips.com/healthcare/about/customer-support/product-securityMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/102847Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01Mitigation, Third Party Advisory, US Government Resource
• https://www.usa.philips.com/healthcare/about/customer-support/product-securityMitigation, Vendor Advisory

Published

Mar 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5432The TIBCO Administrator server component of of TIBCO Softwar…8
• CVE-2018-5433The TIBCO Administrator server component of TIBCO Software I…6.5
• CVE-2018-5434The TIBCO Designer component of TIBCO Software Inc.'s TIBCO …5.8
• CVE-2018-5435The TIBCO Spotfire Client and TIBCO Spotfire Web Player Clie…9.6
• CVE-2018-5436The Spotfire server component of TIBCO Software Inc.'s TIBCO…6.5
• CVE-2018-5437The TIBCO Spotfire Client and TIBCO Spotfire Web Player Clie…6.8
• CVE-2018-5439A Command Injection issue was discovered in Nortek Linear eM…
• CVE-2018-5440A Stack-based Buffer Overflow issue was discovered in 3S-Sma…9.8
• CVE-2018-5441An Improper Validation of Integrity Check Value issue was di…
• CVE-2018-5442A Stack-based Buffer Overflow issue was discovered in Fuji E…9.8
• CVE-2018-5443A SQL Injection issue was discovered in Advantech WebAccess/…
• CVE-2018-5445A Path Traversal issue was discovered in Advantech WebAccess…