Cybersecurity researchers have identified vulnerabilities in Philips IntelliVue WLAN firmware which could be exploited by hackers to install malware.
Two vulnerabilities affect specific IntelliVue MP monitors. Hackers could use the vulnerabilities to install malicious firmware which could impact data flow and lead to an inoperable condition alert at the device and Central Station.
Shawn Loveric, of Finite State, Inc., warned Philips about the flaw. Philips then proactively issued a security advisory to inform users of steps that could be taken to mitigate the risk of a cybersecurity incident.
Hackers would have to be highly skilled to exploit the flaw as they would also have to access to a vulnerable device’s local area network. Philips’ mitigating controls have limited the potential for an attack.
Philips has not uncovered evidence suggesting that hackers are actively exploiting the flaws in the wild.
The first flaw, tracked as CVE-2019-13530, concerns the use of a hard-coded password which could allow an attacker to remotely login via FTP and upload malicious firmware. The second flaw, tracked as CVE-2019-13534, allows the download of code or an executable file from a remote location without performing checks to verify the origin and integrity of the code. The flaws have each been assigned a CVSS v3 base score of 6.4 out of 10.
The following Philips products are affected:
- IntelliVue MP monitors MP20-MP90 (M8001A/2A/3A/4A/5A/7A/8A/10A)
- WLAN Version A, Firmware A.03.09
- IntelliVue MP monitors MP5/5SC (M8105A/5AS)
- WLAN Version A, Firmware A.03.09, Part #: M8096-67501
- IntelliVue MP monitors MP2/X2 (M8102A/M3002A)
- WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C)
- IntelliVue MP monitors MX800/700/600 ((865240/41/42)
- WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C)
WLAN Version B is obsolete, and they will not offer a patch to rectify the flaw. Philips has advised customers to update to the WLAN Module Version C wireless module if they are using any of the patient monitors affected by the flaws. WLAN Version C with current firmware of B.00.31 is not affected by either vulnerability. Mitigating controls include the use of authentication and authorization via WPA2, implementing a firewall rule on the wireless network, and ensuring physical controls are implemented to restrict access to the system.
The flaw in WLAN Version A will be addressed with a patch which Philips plans to release via Incenter by the end of 2019.
