Vulnerability

Philips Alice 6 through R8.0.3 lacks authentication and encryption between nodes

MedDevice Cyber Staff · Mar 27 · 3 min read · Via CISA ICSMA-18-086-01

CISA advisory ICSMA-18-086-01, dated March 27, 2018, covers two vulnerabilities in the Philips Alice 6 System, Version R8.0.3 and prior. Philips reported them itself. Each scores 5.3 under CVSS v3 with a network vector, no privileges and no user interaction.

CVE-2018-5451 (CWE-287) is improper authentication: the software does not prove, or insufficiently proves, that an actor is who it claims to be. CVE-2018-7498 (CWE-311) is missing encryption of sensitive data. CISA's risk evaluation says exploitation may let an attacker see usernames, passwords and personal data.

The two flaws compound. Without node authentication, a malicious machine can stand in for a trusted one, and without encryption the data it receives arrives readable. CISA lists disclosure of personal data by replacing a trusted node with a malicious node as the result, along with data that can be altered or corrupted in transit.

Philips said it would notify users, schedule updates and bring every Alice 6 at R8.0.3 or prior to R8.0.4, with the new version and documentation planned for Q1 of 2019. Users with installation questions go to their local Philips service support team.

A clinical system that trusts any machine claiming to be a peer is only as safe as the network it sits on. Segment it until R8.0.4 is installed.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips will update Alice 6 systems at R8.0.3 or prior to R8.0.4, scheduled for Q1 2019, and coordinate the update with each user. Until then, isolate Alice 6 nodes on a restricted network segment so an untrusted machine cannot pose as a peer or read traffic. Use only Philips-validated changes on the device.

Schedule the R8.0.4 update. Work with Philips service to move every Alice 6 at R8.0.3 or prior to R8.0.4.
Segment the Alice 6 network. Keep Alice 6 nodes on a restricted segment so an unauthorized machine cannot join as a trusted node.
Rotate exposed credentials. Assume usernames and passwords sent between nodes were readable and change them after the update.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

User accounts Handles patient data Hospital network

Alice 6 System

PID-4112 User accounts Handles patient data

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer

Questions & Answers

What is the fix for CVE-2018-5451 in the Philips Alice 6?

Philips will update Alice 6 System devices at Version R8.0.3 or prior to R8.0.4, with the release scheduled for Q1 of 2019, per CISA advisory ICSMA-18-086-01 dated March 27, 2018. The update addresses improper authentication (CVE-2018-5451) and missing encryption (CVE-2018-7498).

What can an attacker do with the Philips Alice 6 vulnerabilities?

According to CISA advisory ICSMA-18-086-01, exploiting CVE-2018-5451 and CVE-2018-7498 in Philips Alice 6 R8.0.3 and prior may expose usernames, passwords and personal data, and personal data can be disclosed by replacing a trusted node with a malicious node.

← Back to Vulnerabilities