Vulnerability

Philips Brilliance CT and MX8000 Dual EXP systems carry hard-coded credential weakness

MedDevice Cyber Staff · May 1 · 3 min read · Via Philips security advisory

Philips published a Responsible Disclosure advisory on May 1, 2018 for a potential, low-risk security vulnerability in its computed tomography systems. Affected are Brilliance 64 version 2.6.2 and below, Brilliance iCT 4.1.6 and below, Brilliance iCT SP 3.2.4 and below, and Brilliance CT Big Bore 2.3.5 and below.

The MX8000 Dual EXP systems are listed for CWE-798 only, the hard-coded credentials weakness. A password compiled into every unit cannot be rotated by the hospital, so containment falls to who can reach the console and the network.

Philips rated the issue low risk and points customers to service for updates.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips rates the CT issue low risk; the affected versions are Brilliance 64 2.6.2 and below, Brilliance iCT 4.1.6 and below, iCT SP 3.2.4 and below, Big Bore 2.3.5 and below, and MX8000 Dual EXP for hard-coded credentials. Contact Philips service for updated software and restrict physical and network access to the consoles.

Check console versions. Compare each Brilliance and MX8000 system against the listed version ceilings.
Request updated software. Ask Philips service for the release above each affected version.
Limit console access. Keep CT consoles in controlled rooms and off general network segments.
Design out shared secrets. For manufacturers, replace built-in credentials with per-unit secrets set at install.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

DICOM or image parsing

MX8000 Dual EXP

PID-3321 User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
SCENARIA View Phase 5.0	Fujifilm Healthcare	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

Which Philips Brilliance CT versions are affected by the May 2018 advisory?

Philips listed Brilliance 64 version 2.6.2 and below, Brilliance iCT 4.1.6 and below, Brilliance iCT SP 3.2.4 and below, Brilliance CT Big Bore 2.3.5 and below, and MX8000 Dual EXP systems (CWE-798 only).

What is the CWE-798 issue in Philips MX8000 Dual EXP CT systems?

Philips lists the MX8000 Dual EXP CT systems for CWE-798, use of hard-coded credentials, in its May 1, 2018 low-risk advisory.

← Back to Vulnerabilities