{"id":"CVE-2021-27456","aliases":["EUVD-2021-14210","GHSA-r7hh-jqhx-m5xr"],"status":"published","title":"Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control","description":"Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.","severity":{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0024,"percentile":0.15237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-921","CWE-922"],"published":"2022-03-23T19:46:21Z","modified":"2026-06-17T03:44:53Z","products":[{"vendor":"philips","product":"gemini 16 slice"},{"vendor":"philips","product":"gemini dual"},{"vendor":"philips","product":"gemini gxl 10 slice"},{"vendor":"philips","product":"gemini gxl 16 slice"},{"vendor":"philips","product":"gemini gxl 6 slice"},{"vendor":"philips","product":"gemini lxl"},{"vendor":"philips","product":"gemini tf 16 w/ tof performance"},{"vendor":"philips","product":"gemini tf 64 w/ tof performance"},{"vendor":"philips","product":"gemini tf big bore"},{"vendor":"philips","product":"gemini tf ready"},{"vendor":"philips","product":"truflight select pet/ct"},{"vendor":"phillips","product":"gemini_882160_firmware"},{"vendor":"phillips","product":"gemini_882300_firmware"},{"vendor":"phillips","product":"gemini_882390_firmware"},{"vendor":"phillips","product":"gemini_882400_firmware"},{"vendor":"phillips","product":"gemini_882410_firmware"},{"vendor":"phillips","product":"gemini_882412_firmware"},{"vendor":"phillips","product":"gemini_882470_firmware"},{"vendor":"phillips","product":"gemini_882471_firmware"},{"vendor":"phillips","product":"gemini_882473_firmware"},{"vendor":"phillips","product":"gemini_882476_firmware"},{"vendor":"phillips","product":"truflight_882438_firmware"}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsma-21-084-01","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.philips.com/productsecurity","tags":["x_refsource_CONFIRM","x_transferred","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27456"},{"url":"https://github.com/advisories/GHSA-r7hh-jqhx-m5xr"}],"sources":{"cve":[{"id":"CVE-2021-27456","title":"Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control","description":"Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.","status":"published","published":"2022-03-23T19:46:21Z","modified":"2025-04-16T16:41:17.401Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-921"],"updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-14210","description":"Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.","status":"published","published":"2022-03-23T19:46:21Z","modified":"2025-04-16T16:41:17Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:52:23.396616Z"}],"ghsa":[{"id":"GHSA-r7hh-jqhx-m5xr","title":"Philips Gemini PET/CT family software stores sensitive information in a removable media device...","description":"Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.","status":"published","published":"2022-03-24T00:00:19Z","modified":"2023-01-27T05:00:59Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:41:47.408375Z"}],"nvd":[{"id":"CVE-2021-27456","description":"Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.","status":"published","published":"2022-03-23T20:15:08.643Z","modified":"2026-06-17T03:44:53.79Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-921","CWE-922"],"updated_at":"2026-11-02T14:07:05.581807Z"}]}}