Vulnerability

Philips DreamMapper 2.24 and earlier write attacker-useful details to log files

MedDevice Cyber Staff · Jul 30 · 2 min read · Via CISA ICSMA-20-212-01

CISA published advisory ICSMA-20-212-01 on July 30, 2020, covering Philips DreamMapper version 2.24 and earlier. Lutz Weimann, Tim Hirschberg, Issam Hbib and Florian Mommertz of SRC Security Research & Consulting GmbH reported the issue.

CVE-2020-14518 is insertion of sensitive information into a log file (CWE-532), with a CVSS v3 base score of 5.3. Information written to the logs can give guidance to a potential attacker, and CISA's risk evaluation describes the exposure as access to log file information containing descriptive error messages. The vector is network, low complexity, no privileges and no user interaction, with low confidentiality impact.

Descriptive errors in logs work as a map for whoever reads them. They name internal components, endpoints and failure states that help an attacker aim a second, more serious attack.

Philips planned a new DreamMapper release that remediates the vulnerability by June 30, 2021, eleven months after the advisory. Users with questions about specific installations are pointed to Philips service support. Logs in a consumer-facing app should carry what support needs and nothing an attacker can reuse.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips planned a DreamMapper release fixing CVE-2020-14518 by June 30, 2021; install it when available and retire version 2.24 and earlier. Until then there is no patch for the verbose logging. Contact Philips service support with questions about specific installations.

Update DreamMapper. Move off version 2.24 and earlier to the Philips release that remediates CVE-2020-14518.
Contact Philips support. Philips service support handles questions about specific DreamMapper installations.
Strip sensitive detail from logs. Keep the error detail support needs and remove anything an attacker could use to target the service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

DreamMapper

PID-34

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Embryo Predict	Alife Health	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
MOSAIQ Oncology Information System	Elekta	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
VELYS Robotic-Assisted Solution	Johnson & Johnson MedTech	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
ASSURE Wearable ECG	Kestra Medical Technologies	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
InPen System App (MMT-8060 (iOS), MMT-8061	Medtronic	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
ID NOW COVID-19 2.0	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Infinity CentralStation Wide	Dräger	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

10 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-14518 in Philips DreamMapper?

CVE-2020-14518 is an insertion of sensitive information into log files (CWE-532, CVSS v3 5.3) in Philips DreamMapper version 2.24 and earlier. Information written to the logs, including descriptive error messages, can give guidance to a potential attacker. CISA disclosed it in advisory ICSMA-20-212-01 on July 30, 2020.

When will Philips fix the DreamMapper logging vulnerability?

Philips planned a new DreamMapper release remediating CVE-2020-14518 by June 30, 2021, according to CISA advisory ICSMA-20-212-01 published July 30, 2020. DreamMapper version 2.24 and earlier are affected.

← Back to Vulnerabilities