LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips e-Alert 2.7 and prior can be shut down without authentication

MedDevice Cyber Staff · Mar 29 · 2 min read · Via CISA ICSMA-22-088-01

CISA published advisory ICSMA-22-088-01 on March 29, 2022, covering CVE-2022-0922 in Philips e-Alert, versions 2.7 and prior. Andrew Dedmon reported it.

The software performs no authentication for critical system functionality (CWE-306). An unauthorized actor on the healthcare facility's network can use that gap to shut the system down remotely. The CVSS v3 score is 6.5: adjacent network, low complexity, no privileges, and high availability impact with no confidentiality or integrity impact.

Philips planned a new release to remediate the flaw before July 2022 and recommended interim mitigations until then. Users can contact Philips service support or read the Philips advisory for details.

Confidentiality and integrity are rated none, so the damage is limited to availability. A shutdown command still deserves the same login as any other admin action, and an unauthenticated one turns every host on the subnet into an off switch.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips planned a fixed e-Alert release before July 2022; until it is installed, versions 2.7 and prior have no patch and need Philips' interim mitigations. The attack requires access to the facility network, so restrict which hosts can reach e-Alert.

Apply Philips' interim mitigations. Follow the guidance in the Philips advisory for e-Alert 2.7 and prior.
Restrict network reach. Limit access to e-Alert to the hosts that need it, since exploitation needs a foothold on the facility network.
Authenticate every control function. Software makers should require an authenticated, authorized session for shutdown and other critical commands.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

e-Alert

PID-331 Hospital network

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2022-0922 in Philips e-Alert?

CVE-2022-0922 (CVSS 6.5) is missing authentication for critical functionality in Philips e-Alert versions 2.7 and prior, which may let an unauthorized actor on the healthcare facility network remotely shut down the system. CISA covered it in advisory ICSMA-22-088-01 on March 29, 2022.

When will Philips fix the e-Alert vulnerability CVE-2022-0922?

Philips planned a new e-Alert release remediating CVE-2022-0922 before July 2022 and recommended interim mitigations in the meantime, per CISA advisory ICSMA-22-088-01.

← Back to Vulnerabilities