Philips IntelliSpace Portal Portal Service PortalUsersDatabase.dll SetInitialPasswordAndSalt hard-coded credentials

Summaryinfo

A vulnerability classified as critical has been found in Philips IntelliSpace Portal and Advanced Visualization Workspace. Impacted is the function SetInitialPasswordAndSalt in the library PortalUsersDatabase.dll of the component Portal Service. This manipulation causes hard-coded credentials. This vulnerability is registered as CVE-2025-3426. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in Philips IntelliSpace Portal and Advanced Visualization Workspace (version now known). Affected by this vulnerability is the function SetInitialPasswordAndSalt in the library PortalUsersDatabase.dll of the component Portal Service. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality. The summary by CVE is:

We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-engineer the application to gain insights into its internal workings, which can potentially lead to the discovery of sensitive information, business logic flaws, and other vulnerabilities. Utilizing this flaw, the attacker was able to identify the Hardcoded credentials from PortalUsersDatabase.dll, which contains .NET remoting definition. Inside the namespace PortalUsersDatabase, the class Users contains the functions CreateAdmin and CreateService that are used to initialize accounts in the Portal service. Both CreateAdmin and CreateService functions contain a hardcoded encrypted password along with its respective salt that are set with the function SetInitialPasswordAndSalt. This issue affects IntelliSpace Portal: 12 and prior; Advanced Visualization Workspace: 15.

The weakness was published by Omar A Crespo. This vulnerability is known as CVE-2025-3426 since 04/07/2025. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Medical Device Software

Vendor

• Philips

Name

• Advanced Visualization Workspace
• IntelliSpace Portal

License

• commercial

Website

• Vendor: https://www.philips.ch/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion