Vulnerabilities Identified in Philips IntelliBridge, Patient Information Center and Efficia Patient Monitors
Five vulnerabilities have been identified that affect the IntelliBridge EC 40 and EC 80 Hub, Philips Patient Information Center iX, and Efficia CM series patient monitors.
IntelliBride EC 40 and EC 80 Hub
Two vulnerabilities have been identified that affect C.00.04 and prior versions of the IntelliBridge EC 40 and EC 80 Hub. Successful exploitation of the vulnerabilities could allow an unauthorized individual to execute software, change system configurations, and update/view files that may include unidentifiable patient data.
The first vulnerability is due to the use of hard-coded credentials – CVE-2021-32993 – in the software for its own inbound authentication, outbound communication to external components, or the encryption of internal data. The second vulnerability is an authentication bypass issue – CVE-2021-33017. While the standard access path of the product requires authentication, an alternative path has been identified that does not require authentication.
Both vulnerabilities have been assigned a CVSS v3 severity score of 8.1 out of 10.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Philips has not yet issued an update to correct the vulnerabilities but expects to fix the flaws by the end of the year. In the meantime, Philips recommends only deploying the products within Philips authorized specifications, and only using Philips-approved software, software configuration, system services, and security configurations. The devices should also be logically or physically isolated from the hospital network.
Patient Information Center iX and Efficia CM Series Patient Monitors
Three vulnerabilities have been identified that affect the Philips Patient Information Center iX and Efficia CM series patient monitors. The flaws could be exploited to gain access to patient data and to conduct a denial-of-service attack. While exploitation has a low attack complexity, the flaws could only be exploited via an adjacent network.
The vulnerabilities affect the following Philips products:
- Patient Information Center iX (PIC iX): Versions B.02, C.02, C.03
- Efficia CM Series: Revisions A.01 to C.0x and 4.0
Vulnerable versions of the PIC iX do not adequately validate input to determine whether the input has the properties to be processed safely and correctly. The vulnerability is tracked as CVE-2021-43548 and has been assigned a CVSS severity score of 6.5 out of 10.
A hard-coded cryptographic key has been used which means it is possible for encrypted data to be recovered from vulnerable versions of the PIC iX. The flaw is tracked as CVE-2021-43552 and has a CVSS score of 6.1.
A broken or risky cryptographic algorithm means sensitive data may be exposed in communications between PIC iX and Efficia CM Series patient monitors. The vulnerability is tracked as CVE-2-21-43550 and has a CVSS score of 5.9.
CVE-2021-43548 has been remediated in PIC iX C.03.06 and updates to fix the other two vulnerabilities are due to be released by the end of 2022.
To reduce the potential for exploitation of the vulnerabilities, the products should only be used in accordance with Philips authorized specifications, which include physically or logically isolating the devices from the hospital local area network, and using a firewall or router that can implement access control lists restricting access in and out of the patient monitoring network for only necessary ports and IP addresses.
Philips-issued hardware has Bitlocker Drive Encryption enabled by default and this should not be disabled. Prior to disposal, NIST SP 800-88 media sanitization guidelines should be followed. Patient information is not included in archives by default, so if archives are exported that contain patient information, the information should be stored securely with strong access controls.
