HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

New Philips iSite and IntelliSpace PACS Vulnerability Identified

ICS-CERT has issued an advisory about a medium severity vulnerability in Philips iSite and IntelliSpace PACS. The weak password vulnerability is present in all versions of iSite PACS and IntelliSpace PACS. If exploited, the confidentiality, integrity, and availability of a component of the system could be impacted.

The vulnerability is being tracked as CVE-2018-17906 (CWE-521) and concerns the use of default credentials and a lack of authentication within third-party software. The vulnerability would require only a low level of skill to exploit, although the potential for exploitation is limited as an attacker would first need to gain local network access. The vulnerability has been assigned a CVSS v3 base score of 6.3 and was reported to Philips by a user. Philips self-reported the flaw to NCCIC.

To prevent exploitation of the vulnerability, healthcare providers should restrict access to vulnerable iSite and IntelliSpace PACS systems to authorized personnel and follow standard security best practices.

Phillips recommends only running IntelliSpace PACS installations in a managed service environment that conforms to NCCIC recommendations to reduce the risk of exploitation of the vulnerability. Measures that should be implemented include the use of a virtual private network, ensuring Philips iSite and IntelliSpace PACS are not accessible over the Internet, separation of iSite and IntelliSpace PACS from other networks, and to ensure they are protected by a firewall.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Through the managed service environment, Philips offers automated anti-virus protection to continuously scan systems and remediate threats. Phillips also runs a monthly patch program to address known vulnerabilities. Participants in the program will receive an update to address this and future vulnerabilities in a timely fashion.

Philips notes that the iSite 3.6 platform is now at end of life and has reached end of service, so upgrades are strongly recommended.

In October, ICS-CERT issued an advisory over six Philips iSite/IntelliSpace PACS vulnerabilities and a further two vulnerabilities in Philips IntelliSpace cardiovascular vulnerabilities were reported in August. In each case, rapid action was taken to address the vulnerabilities through the Philips’ Secure Development Lifecycle (SDL).

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.