Vulnerability

Philips Clinical Collaboration Platform 12.2.1 and earlier has five web and authentication flaws

MedDevice Cyber Staff · Sep 17 · 3 min read · Via CISA ICSMA-20-261-01

CISA published advisory ICSMA-20-261-01 on September 17, 2020, for Philips Clinical Collaboration Platform versions 12.2.1 and earlier. Northridge Hospital Medical Center found the issues and reported them to Philips.

Five CVEs are listed. CVE-2020-14525 (CVSS v3 3.5) covers user-controllable input that reaches a page served to other users without neutralization. CVE-2020-16198 (CVSS 5.0) is weak proof of identity when a client claims to be a given user. CVE-2020-16200 (CVSS 6.5) is uncontrolled resource consumption that an attacker can drive to exhaustion.

CVE-2020-16247 carries the highest score, 6.8, for exposing a resource to the wrong control sphere. CVE-2020-14506 (CVSS 3.4) is an input validation issue that needs local, high-privilege access. Most vectors require adjacent or local access, which keeps the ratings in the medium band.

Philips released Clinical Collaboration Platform 12.2.5 in May 2020, remediating the weaknesses mapped to CWE-16, CWE-352, CWE-83 and CWE-693. The fifth, CWE-757 (selection of a less-secure algorithm during negotiation), requires manual intervention by Philips.

Hospital teams that test the clinical software they run, and report what they find, shorten the window for everyone else on the same version.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade Philips Clinical Collaboration Platform from 12.2.1 or earlier to 12.2.5, released May 2020. Contact Philips to schedule the manual intervention that addresses the CWE-757 algorithm negotiation weakness. Keep the platform reachable only from the clinical network until both are done.

Upgrade to 12.2.5. Move every Clinical Collaboration Platform instance at 12.2.1 or earlier to 12.2.5.
Book the CWE-757 fix. Ask Philips service to perform the manual intervention for the less-secure algorithm negotiation issue.
Restrict access. Limit the platform to clinical network segments, since most CVSS vectors in the advisory need adjacent access.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

User accounts Hospital network

Clinical Collaboration Platform

PID-311 Web interface

Fix the class in your product

Field input is reflected into a WebView without encoding, so input becomes script in the app context. As the maker, context-encode every value before it renders, set a strict content security policy, and prefer native rendering for sensitive data.

Encode at every sink. Render user data with textContent or an auto-escaping template, never innerHTML.
Set a strict CSP. Block inline and injected script as a second layer.
Prefer native rendering. Keep PHI out of a WebView where a missed encode becomes code.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

10 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Which version of Philips Clinical Collaboration Platform fixes the ICSMA-20-261-01 vulnerabilities?

Per CISA advisory ICSMA-20-261-01, Philips Clinical Collaboration Platform 12.2.5, released in May 2020, remediates the CWE-16, CWE-352, CWE-83 and CWE-693 weaknesses among CVE-2020-14506, CVE-2020-14525, CVE-2020-16198, CVE-2020-16200 and CVE-2020-16247. The remaining CWE-757 weakness needs manual intervention by Philips.

Who reported the Philips Clinical Collaboration Platform vulnerabilities?

Northridge Hospital Medical Center reported the five Clinical Collaboration Platform vulnerabilities to Philips, according to CISA advisory ICSMA-20-261-01 published September 17, 2020.

← Back to Vulnerabilities