CVE-2018-5451
9.8
CRITICAL · CVSS 3.0 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or the ability to execute arbitrary code.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.65% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-03-28 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| philips | alice 6 |
| philips | alice 6 firmware |
References
→ the Explorer · watch your stack · NVD