Vulnerability

Philips Brilliance CT scanners allow kiosk breakout and carry hard-coded credentials

MedDevice Cyber Staff · May 3 · 3 min read · Via CISA ICSMA-18-123-01

CISA published advisory ICSMA-18-123-01 on May 3, 2018, covering three vulnerabilities in Philips Brilliance computed tomography systems. Affected are Brilliance 64 version 2.6.2 and prior, Brilliance CT Big Bore 2.3.5 and prior, and Brilliance iCT 3.2.4 and prior and 4.1.6 and prior. Philips reported the issues.

The scanners run user functions inside a contained kiosk on Microsoft Windows. CVE-2018-8853 (CWE-250, CVSS 6.1) says Windows boots by default with elevated privileges, so a kiosk application, a user or an attacker can pick up privileges they should not have. CVE-2018-8861 (CWE-668, CVSS 6.1) covers breaking out of the kiosk into the underlying operating system.

CVE-2018-8857 (CWE-798) is the highest at 8.4. The software contains fixed credentials, such as a password or cryptographic key, used for its own authentication, for outbound connections or to encrypt internal data. The vector needs local access but no privileges and no user interaction.

Together they let a limited kiosk user end up with Windows-level control. Per the advisory, that can mean running software and viewing or changing files that include PHI, directories or system configuration. Philips had received no reports of exploitation.

Philips remediated the hard-coded credentials in Brilliance iCT 4.x and above, and the iCT-iPatient (v4.x) Instructions for Use describe credential management. For the kiosk issues Philips is assessing remediation in future product introductions and upgrades across its CT and AMI modalities. The MX8000 Dual EXP, out of support since 2017, gets a replacement recommendation instead.

A kiosk shell on top of an admin-level Windows session is a curtain over the operating system. Run the clinical application as a least-privilege account so a breakout lands somewhere useless.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips remediated the hard-coded credentials (CVE-2018-8857) in Brilliance iCT 4.x and above; the kiosk breakout and Windows privilege flaws have no patch yet and are slated for future upgrades. All three need local access, so physical control of the scanner console is the main compensating control. MX8000 Dual EXP owners should plan a replacement.

Move iCT systems to 4.x or later. Philips fixed the hard-coded credentials in Brilliance iCT 4.x and above, and the iCT-iPatient IFU covers credential management.
Restrict access to the console. Every flaw in the advisory needs local access, so keep the scanner workstation in a controlled area.
Replace the MX8000 Dual EXP. It has been out of support since 2017 and Philips recommends replacement.
Run the kiosk without admin rights. Device makers should boot the clinical shell under a least-privilege Windows account so a kiosk escape gains nothing.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Handles patient data

Brilliance CT

PID-23 Named operating system Handles patient data

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2018-8857 in Philips Brilliance CT systems?

CVE-2018-8857 (CVSS 8.4) is hard-coded credentials in Philips Brilliance CT software, such as a password or cryptographic key used for authentication or encryption. CISA advisory ICSMA-18-123-01 of May 3, 2018 lists Brilliance 64, Brilliance CT Big Bore and Brilliance iCT as affected. Philips remediated it for Brilliance iCT 4.x and above.

Can a user escape the kiosk on a Philips Brilliance CT scanner?

Yes. CVE-2018-8861 and CVE-2018-8853 (both CVSS 6.1) let a limited kiosk user or attacker break out of the Brilliance CT kiosk and gain elevated privileges in the underlying Windows operating system, per CISA advisory ICSMA-18-123-01. Philips is assessing fixes in future CT product upgrades.

Is the Philips MX8000 Dual EXP still supported?

No. Per CISA advisory ICSMA-18-123-01, the Philips MX8000 Dual EXP has been out of support since 2017, and Philips recommends a replacement based on user need.

← Back to Vulnerabilities