Vulnerability

Philips lists 14 products exposed to the HiveNightmare Windows privilege escalation

MedDevice Cyber Staff · Sep 1 · 2 min read · Via Philips security advisory

Philips issued an advisory on September 1, 2021 on CVE-2021-36934, the Microsoft Windows elevation of privilege vulnerability called HiveNightmare. A successful exploit lets an attacker run arbitrary code with system privileges.

Philips lists ACSYS Gateway 1.x, ACSYS and ACSYS-ER, e-Whiteboard 1.x, ORSYS G4 and X1, Holter Recorder DigiTrak XT 3.0.3, SPhAERA 5.x, CDE 2.x, IntelliSpace Perinatal K.0, ST80i A.02, Diagnostic Site Server, IntelliSpace Portal Workstation 11.0 and 12.0, Vi-Pros 1.x, eTriage 2.x and IntelliVue XDS M.0 and N.01.

HiveNightmare needs local access first, so it chains after phishing or a shared login. Fix the shared logins too.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's CVE-2021-36934 fix, including removing old shadow copies, on the 14 listed Philips products as Philips authorizes. Restrict local logons on those systems.

Match the list to your fleet. Identify installs of the 14 listed products.
Apply the validated fix. Install Microsoft's update with the shadow copy cleanup once Philips clears it.
Restrict local logons. Remove shared accounts and limit who can sign in locally.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

User accounts

IntelliSpace Portal Workstation

Named operating system

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by HiveNightmare CVE-2021-36934?

Philips' September 1, 2021 advisory lists 14 products for CVE-2021-36934, including IntelliSpace Portal Workstation 11.0 and 12.0, IntelliSpace Perinatal K.0, IntelliVue XDS M.0 and N.01, ST80i A.02, SPhAERA 5.x and Holter Recorder DigiTrak XT.

What can an attacker do with CVE-2021-36934?

CVE-2021-36934, known as HiveNightmare, is a Windows elevation of privilege flaw that lets an attacker run arbitrary code with system privileges, as Philips described on September 1, 2021.

← Back to Vulnerabilities