CVE-2023-40704

Executive Summary

CVE-2023-40704 affects Philips PACS (Picture Archiving and Communication System) due to the use of default, non-unique, and non-complex passwords during installation. An attacker who discovers or leaks the default password can gain unauthorized access to the database, leading to system availability loss and data integrity compromise. The vulnerability is rated with a CVSS score of 6.8 (Medium), with an EPSS probability of 0.0% indicating low exploitation likelihood in the wild. No public exploit code or proof-of-concept is available, and no patch has been released by the vendor.

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby), so no supply chain analysis is required.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Base Score: 6.8 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: Low (I:L) – limited data modification possible.
• Availability Impact: High (A:H) – potential for denial of service or system disruption.

Threat Level: Medium. The vulnerability is easy to exploit remotely, but the lack of public exploits and low EPSS score reduces immediate risk. However, if default credentials are discovered, the impact on availability and integrity is significant.

Deep Dive & Mechanics

Philips PACS systems are used in medical imaging to store, retrieve, and distribute images. During installation, the system creates a default password for database access. This password is not unique per installation and is not required to be complex. An attacker who obtains this default password (e.g., through leaked documentation, brute-force, or insider knowledge) can authenticate to the database.

Once authenticated, the attacker can:

• Modify or delete medical image data, compromising data integrity.
• Cause denial of service by corrupting database tables or overloading the system.
• Potentially pivot to other connected systems if the database is misconfigured.

The vulnerability is rooted in weak credential management (CWE-521) and does not require any authentication bypass or injection technique.

Vulnerable vs. Patched Code

No code-level comparison is available because the vulnerability is configuration-based, not code-based. The issue lies in the installation process, not in a specific software function. The "vulnerable" state is any installation that uses the default password; the "patched" state would require enforcing unique, complex passwords during setup.

Exploitation & Lab Setup

Red Team

Objective: Gain unauthorized database access using default credentials.

Prerequisites:

• Network access to the Philips PACS database port (typically 5432 for PostgreSQL).
• Knowledge of the default password (e.g., "philips" or "pacs").

Steps:

1. Scan for open PostgreSQL ports on the target network.
2. Attempt to connect using the default credentials.
3. If successful, execute SQL commands to extract or modify data.

Example connection command:

psql -h <target_ip> -p 5432 -U postgres -d pacsdb -W

Enter the default password when prompted.

Post-exploitation:

• Dump database contents: pg_dump -h <target_ip> -U postgres pacsdb > dump.sql
• Modify data: UPDATE images SET status='deleted' WHERE id=1;

Blue Team

Detection:

• Monitor for multiple failed login attempts to the database.
• Alert on successful logins from unexpected IP addresses.
• Check for default password usage in configuration files.

Honeypot:

• Deploy a fake PACS database with default credentials to detect scanning activity.

Hardening:

• Immediately change default passwords after installation.
• Enforce password complexity and rotation policies.
• Restrict database access to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: Connections to port 5432 from unusual external IPs.
• Logs: Database authentication logs showing successful login with default username (e.g., postgres or pacsadmin).
• File: Presence of default password in configuration files (e.g., pg_hba.conf or application.properties).
• Behavior: Unusual SQL queries (e.g., SELECT * FROM pg_shadow or DROP TABLE).

Detection Engineering

YARA Rule

rule CVE_2023_40704_Default_Password_Detection {
    meta:
        description = "Detects default password strings in Philips PACS configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-40704"
    strings:
        $default_pwd1 = "philips" ascii wide nocase
        $default_pwd2 = "pacs" ascii wide nocase
        $default_pwd3 = "password" ascii wide nocase
        $config_file = "pg_hba.conf" ascii wide nocase
    condition:
        any of ($default_pwd*) and $config_file
}

Sigma Rule

title: Philips PACS Default Password Login Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects successful login to Philips PACS database using default credentials
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: postgresql
detection:
    selection:
        user: "postgres"
        source_ip: "0.0.0.0/0"
        action: "login"
        result: "success"
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 5432 (msg:"CVE-2023-40704 Philips PACS Default Password Attempt"; flow:to_server,established; content:"|70 61 73 73 77 6f 72 64|"; nocase; sid:1000001; rev:1;)

Note: The hex content |70 61 73 73 77 6f 72 64| represents the string "password". Adjust based on actual default password.

Remediation & Mitigation

Immediate Actions:

1. Change all default passwords on Philips PACS systems immediately.
2. Enforce password complexity (minimum 12 characters, mixed case, numbers, symbols).
3. Implement multi-factor authentication for database access if supported.

Long-term Measures:

• Apply any vendor patches when released.
• Conduct regular security audits of medical device configurations.
• Segment PACS systems from general network traffic.
• Monitor database logs for anomalous access patterns.

Workaround:

• Restrict database access to only authorized IP addresses using firewall rules.
• Disable remote database access if not required.

Valters IT