Vulnerability

Philips EncoreAnywhere exposes sensitive data in its HTTP headers

MedDevice Cyber Staff · May 17 · 2 min read · Via CISA ICSMA-18-137-02

CISA published advisory ICSMA-18-137-02 on May 17, 2018, on an information exposure flaw in Philips EncoreAnywhere APAC, versions 2.36.3.3 and earlier. Philips reported the issue itself. It is tracked as CVE-2018-8863 (CWE-200), with a CVSS v3 base score of 5.9.

According to the advisory, the HTTP header contains data an attacker may be able to use to gain sensitive information. CISA's risk evaluation adds that exploitation could result in unencrypted communication and potential improper disclosure of sensitive data. The vector is network reachable and needs no privileges, but attack complexity is high, and CISA had no reports of public exploitation.

Philips said it had identified and put in place mitigations, was still assessing more, and expected full implementation and documentation by September 2018. The advisory names no fixed version.

Response headers get skipped in reviews because they come from server and framework defaults nobody wrote on purpose. Strip version and configuration detail from every header before a service faces the internet.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips has applied mitigations for CVE-2018-8863 in EncoreAnywhere APAC 2.36.3.3 and earlier and planned full implementation and documentation by September 2018; the advisory names no fixed version. Users should confirm with Philips that the mitigations cover their deployment and keep access to the service behind encrypted channels.

Confirm the Philips mitigations apply. Ask Philips whether the mitigations for CVE-2018-8863 are in place for your EncoreAnywhere APAC deployment.
Force encrypted connections. Reach the service only over encrypted channels, since CISA notes exploitation could result in unencrypted communication.
Limit network exposure. Keep the systems off the open internet where possible and use a VPN when remote access is required.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Cloud connectivity

Contributing

Web interface

EncoreAnywhere APAC

PID-311

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

10 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2018-8863 in Philips EncoreAnywhere?

CVE-2018-8863 (CWE-200, CVSS v3 5.9) is an information exposure flaw in Philips EncoreAnywhere APAC 2.36.3.3 and earlier, where the HTTP header contains data an attacker may use to gain sensitive information. CISA disclosed it in advisory ICSMA-18-137-02 on May 17, 2018.

Is there a fix for the Philips EncoreAnywhere HTTP header vulnerability?

Philips said it had put mitigations in place for CVE-2018-8863 in EncoreAnywhere APAC 2.36.3.3 and earlier and expected full implementation and documentation by September 2018, per CISA advisory ICSMA-18-137-02. The advisory lists no fixed version.

← Back to Vulnerabilities