CVE-2023-40704 is a medium severity default credential issue in Philips Vue PACS. NVD scores it 6.8. The installer does not require a unique, complex database password. Philips says no action is needed due to low exploitability, but customers can ask Philips to update their database passwords.
What's affected
The record names Philips Vue PACS. CISA's ICS medical advisory ICSMA-24-200-01 (Update A) lists Vue PACS versions prior to 12.2.8.410 as affected. The weakness is CWE-1392, use of default credentials.
The product does not require a unique and complex password during installation. Using Philips's default password could put the PACS system at risk if the password were guessed or leaked. An attacker with database access could affect system availability and data integrity.
Read the fix statement carefully. The advisory covers two CVEs. For the other one, CVE-2021-28165, it says version 12.2.8.410, released October 2023, prevents that issue. For CVE-2023-40704 it says Philips recommends no action because of low risk of exploitability, but customers can request that Philips update the database passwords. It does not state that 12.2.8.410 fixes the default password. Managed service users get new releases as resources allow, subject to country regulations.
Score note: NVD gives 6.8 on CVSS 3.1 with an adjacent network vector and a high privilege requirement. CISA's advisory gives a CVSS v4 score of 5.7 for the same CVE. These are different scoring versions, not a disagreement about the flaw. Not in KEV, and the advisory does not say it is exploited in the wild.
How to check if you're exposed
Ask your Philips contact or your biomedical engineering team for the installed Vue PACS version, and compare it with 12.2.8.410. Then ask a more important question: has the database password ever been changed from the installed default? The installer behaviour in the record means the answer may be no.
Review the network around the PACS server too. The vector is adjacent and requires high privileges, so the realistic route is a person or device already inside the hospital network. Check which segments can reach the database port, and whether access is limited to the application servers that need it.
What to do now
- Confirm the Vue PACS version and whether it is below 12.2.8.410.
- Contact Philips or your service provider and request a database password update, as the advisory allows.
- Restrict network access to the database server to the application hosts that need it, and keep PACS on a segment behind firewalls.
- Follow the mitigations in CISA's advisory, including the minimising of network exposure and the use of a VPN for remote access where needed.
- If you use managed services, ask when the next release will be offered to you.
Why it matters
Default credentials are a hygiene failure that can turn a small foothold into a large one. If every installation shares a known password, the secret is only as private as the vendor's documentation, past staff and old support tickets.
The score is held down because the attacker needs a position on the local network and high privileges. In a clinical environment, though, the data and availability of imaging systems carry real operational weight, so the risk is better understood through your own network design than through the number alone.
Quick check
Does upgrading to 12.2.8.410 fix the default password?
The advisory ties 12.2.8.410 to the other CVE in the notice. For this one it recommends a password update request, so confirm with Philips.
Who is at risk?
The vector is adjacent with high privileges required, so the realistic exposure comes from people or devices already on the hospital network.
Sources
- CISA ICS medical advisory ICSMA-24-200-01
- Philips product security
- Safeguard Gold entry for CVE-2023-40704
Last reviewed: 19 October 2026.
