Philips Intellibridge EC40 Firmware vulnerabilities

3 CVEs affecting Philips Intellibridge EC40 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-33017, published 2021-12-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-33017, published 2021-12-27. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
CVE-2019-18241, published 2019-11-26. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak…
CVE-2021-32993, published 2021-12-27. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication…