New Philips iSite and IntelliSpace PACS Vulnerability Identified
ICS-CERT has issued an advisory about a medium severity vulnerability in Philips iSite and IntelliSpace PACS. The weak password vulnerability is present in all versions of iSite PACS and IntelliSpace PACS. If exploited, the confidentiality, integrity, and availability of a component of the system could be impacted.
The vulnerability is being tracked as CVE-2018-17906 (CWE-521) and concerns the use of default credentials and a lack of authentication within third-party software. The vulnerability would require only a low level of skill to exploit, although the potential for exploitation is limited as an attacker would first need to gain local network access. The vulnerability has been assigned a CVSS v3 base score of 6.3 and was reported to Philips by a user. Philips self-reported the flaw to NCCIC.
To prevent exploitation of the vulnerability, healthcare providers should restrict access to vulnerable iSite and IntelliSpace PACS systems to authorized personnel and follow standard security best practices.
Phillips recommends only running IntelliSpace PACS installations in a managed service environment that conforms to NCCIC recommendations to reduce the risk of exploitation of the vulnerability. Measures that should be implemented include the use of a virtual private network, ensuring Philips iSite and IntelliSpace PACS are not accessible over the Internet, separation of iSite and IntelliSpace PACS from other networks, and to ensure they are protected by a firewall.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Through the managed service environment, Philips offers automated anti-virus protection to continuously scan systems and remediate threats. Phillips also runs a monthly patch program to address known vulnerabilities. Participants in the program will receive an update to address this and future vulnerabilities in a timely fashion.
Philips notes that the iSite 3.6 platform is now at end of life and has reached end of service, so upgrades are strongly recommended.
In October, ICS-CERT issued an advisory over six Philips iSite/IntelliSpace PACS vulnerabilities and a further two vulnerabilities in Philips IntelliSpace cardiovascular vulnerabilities were reported in August. In each case, rapid action was taken to address the vulnerabilities through the Philips’ Secure Development Lifecycle (SDL).
