Vulnerability

Philips DoseWise Portal hard-codes its database credentials and stores logins in clear text

MedDevice Cyber Staff · Aug 17 · 3 min read · Via CISA ICSMA-17-229-01

CISA published advisory ICSMA-17-229-01 on August 17, 2017, covering two vulnerabilities in the Philips DoseWise Portal (DWP), a web-based application. The affected versions are 1.1.7.333 and 2.1.1.3069.

CVE-2017-9656 (CWE-798) scores 9.1 under CVSS v3. The backend database uses hard-coded credentials for a database account with privileges over the confidentiality, integrity and availability of that database. Those credentials sit in backend system files.

CVE-2017-9654 (CWE-312, CVSS 6.5) is the companion flaw: the application stores login credentials in clear text within the same kind of backend system files. An attacker who reaches those files collects both the user logins and the database account.

The critical score carries a precondition. Elevated privileges are first required to reach the backend system files, which is why the vector reads PR:H. Once that step is done, a remote attacker gains access to the DWP database, and that database contains PHI.

Philips will support every user of version 1.1.7.333 to reconfigure the installation, changing and fully encrypting all stored passwords. The advisory text names no separate step for 2.1.1.3069.

A database password baked into the product is the same on every install, so one leaked config file opens every site. Generate the secret per installation and keep it out of readable files.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no software patch named in the advisory. Philips is supporting DoseWise Portal 1.1.7.333 users to reconfigure the installation, change all stored passwords and fully encrypt them. Sites on 2.1.1.3069 should contact Philips, and every site should restrict who can reach the backend system files.

Request the Philips reconfiguration. Philips supports DoseWise Portal 1.1.7.333 users to change and fully encrypt all stored passwords.
Lock down the backend server. Exploitation first needs elevated access to the backend system files, so limit administrative accounts on that host.
Rotate the database account. Treat the old database credentials as known and replace them once the reconfiguration is done.
Issue secrets per install. Device and software makers should generate database credentials at installation and store them encrypted, never in shipped files.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database User accounts

Contributing

Web interface Handles patient data

DoseWise Portal

PID-311 PID-3321 Web interface User accounts Patient or study database Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management System	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What are CVE-2017-9656 and CVE-2017-9654 in Philips DoseWise Portal?

CVE-2017-9656 (CVSS 9.1) is hard-coded credentials for the DoseWise Portal backend database, and CVE-2017-9654 (CVSS 6.5) is login credentials stored in clear text in backend system files. Both affect DoseWise Portal 1.1.7.333 and 2.1.1.3069, per CISA advisory ICSMA-17-229-01 of August 17, 2017.

How does Philips fix the DoseWise Portal 1.1.7.333 credential flaws?

Philips will support all users of DoseWise Portal 1.1.7.333 to reconfigure the installation so that all stored passwords are changed and fully encrypted, addressing CVE-2017-9656 and CVE-2017-9654 from CISA advisory ICSMA-17-229-01.

Does exploiting the Philips DoseWise Portal hard-coded credentials expose patient data?

Yes. Per CISA advisory ICSMA-17-229-01, an attacker who first gains elevated privileges to the backend system files can use the hard-coded credentials (CVE-2017-9656) to reach the DoseWise Portal database, which contains PHI.

← Back to Vulnerabilities