Philips Interventional Workstations OS Command Injection

An attacker supplies externally influenced input to an upstream component of the affected Philips medical software (Interventional Workspot, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, or ViewForum) [ref_id=1]. Because the software fails to neutralize special elements in that input before incorporating it into an OS command, the attacker can inject arbitrary command syntax. The crafted payload is then passed to a downstream component that executes the modified OS command, enabling the attacker to achieve unintended command execution on the underlying system [ref_id=1].

The advisory does not identify specific functions, files, or code paths [ref_id=1]. The affected products are Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), and ViewForum (Release 6.3V1L10) [ref_id=1].

The advisory does not include a patch diff or specific remediation code [ref_id=1]. Philips has not published a software update for this CVE in the referenced advisory archive; the advisory only describes the vulnerability class and affected product versions [ref_id=1]. Users are directed to contact their local Philips service support team for product-specific remediation guidance [ref_id=1].