Vulnerability

Philips HealthSuite Health Android app uses encryption too weak for its data

MedDevice Cyber Staff · Dec 6 · 2 min read · Via CISA ICSMA-18-340-01

CISA published advisory ICSMA-18-340-01 on December 6, 2018, for the Philips HealthSuite Health app for Android, all versions. The single issue is CVE-2018-19001, inadequate encryption strength (CWE-326), with a CVSS v3 base score of 3.5. An anonymous party reported it.

The advisory says the app uses simple encryption that is not strong enough for the protection the data needs. The vector requires physical access to the phone, and the impact on confidentiality and integrity is low, which explains the score.

Philips said a release fixing the issue would ship in the first quarter of 2019. In the meantime it advised against jail-breaking or rooting the phone, since a rooted device loses the operating system protections the app relies on.

Home health apps sit on phones the manufacturer does not control. Encryption chosen with the assumption that the platform will hold the line is only as good as the least careful user's device.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the HealthSuite Health Android app to the Philips release due in the first quarter of 2019 once it is available. Until then, keep the app off rooted or jail-broken phones and keep the phone itself locked. Manufacturers should not rely on a custom or lightweight cipher for health data stored on a phone.

Update the app. Install the fixed HealthSuite Health release from the app store when Philips publishes it.
Keep phones unrooted. Do not run the app on a rooted or jail-broken Android device.
Lock the phone. Use a screen lock, since CVE-2018-19001 requires physical access to the device.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Mobile app

Contributing

Home use Handles patient data

HealthSuite Health Android App

PID-4113 Mobile app Home use

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Same platformAndroid	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same platformAndroid	No feedback feed from manufacturer
myMerlin Mobile Application (Android)	Abbott	Same platformAndroid	No feedback feed from manufacturer
TipTraQ	Pranaq	Same platformAndroid app	No feedback feed from manufacturer
All-Day Clear Slim ADCS1 Hearing Aid. All-Day Clear ADC1 Hearing Aid	Sonova	Same platformAndroid	No feedback feed from manufacturer
t:slim X2 insulin pump with interoperable technology	Tandem Diabetes Care	Same platformAndroid app	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same platformAndroid	No feedback feed from manufacturer

5 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2018-19001 in the Philips HealthSuite Health app?

CVE-2018-19001 is inadequate encryption strength (CWE-326, CVSS v3 3.5) in all versions of the Philips HealthSuite Health Android app, disclosed in CISA advisory ICSMA-18-340-01 on December 6, 2018. Exploitation requires physical access to the phone.

Is there an update for the Philips HealthSuite Health Android app encryption flaw?

Philips planned a release fixing CVE-2018-19001 in the HealthSuite Health Android app for the first quarter of 2019, per CISA advisory ICSMA-18-340-01. Until then it advised users not to jail-break or root their phones.

← Back to Vulnerabilities