Medium 6.5HealthcarePublished Jan 20, 2021

CVE-2020-27298Philips Interventional Workstations OS Command Injection

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Philips Interventional Workspot and 5 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.90%, higher than 59% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Philips Interventional Workspot

Exploited in the last 30 days

Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.90% (percentile 59)
Assigned by: icscert
NVD analysis: Modified
Record last updated: Jun 4, 2025
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Philips Interventional Workspot philips:interventional_workspot (from the name)	Release 1.3.2; Release 1.4.0; Release 1.4.1; Release 1.4.3; Release 1.4.5	CNA record
Philips Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live philips:coronary_tools_dynamic_coronary_roadmap_stentboost_live (from the name)	Release 1.0	CNA record
Philips ViewForum philips:viewforum (from the name)	Release 6.3V1L10	CNA record
philips coronary_tools philips:coronary_tools	1.0	NVD
philips dynamic_coronary_roadmap philips:dynamic_coronary_roadmap	1.0	NVD
philips interventional_workspot philips:interventional_workspot	1.3.2; 1.4.0; 1.4.1; 1.4.3; 1.4.5	NVD
philips stentboost_live philips:stentboost_live	1.0	NVD
philips viewforum philips:viewforum	6.3v1l10	NVD

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-21-019-01x-refsource-misc
https://www.philips.com/a-w/security/security-advisories/product-security-2021.html#2021_archive
https://us-cert.cisa.gov/ics/advisories/icsma-21-019-01third-party-advisory, us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.