LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips IntelliBridge EC40 and EC80 contain hard-coded credentials and an authentication bypass

MedDevice Cyber Staff · Nov 18 · 2 min read · Via Philips security advisory

Philips issued an advisory on November 18, 2021 for IntelliBridge EC40 and EC80 systems. The affected software, C.00.04 and prior, contains hard-coded credentials and an authentication bypass using an alternate path or channel.

The EC40 and EC80 are bedside hubs that connect monitors and other devices to hospital systems. A hard-coded credential is the same on every unit, so learning it once opens the fleet.

Hard-coded credentials never get rotated. The upgrade is the only real fix.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

IntelliBridge EC40 and EC80 at C.00.04 and prior ship hard-coded credentials and an authentication bypass. Upgrade through Philips service and keep the hubs on a restricted clinical segment until then.

Inventory EC40 and EC80 hubs. Find every unit at C.00.04 or earlier.
Upgrade through Philips. Request the release that removes the hard-coded credentials.
Restrict hub access. Limit network reach to the hubs to the integration servers that need it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Hospital network

IntelliBridge EC40 and EC80

User accounts Hospital network

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What vulnerabilities affect Philips IntelliBridge EC40 and EC80?

Philips disclosed on November 18, 2021 that IntelliBridge EC40 and EC80 software at C.00.04 and prior contains hard-coded credentials and an authentication bypass using an alternate path or channel.

Which IntelliBridge EC40 and EC80 versions have hard-coded credentials?

Philips IntelliBridge EC40 and EC80 versions C.00.04 and prior are affected, according to the November 18, 2021 advisory.

← Back to Vulnerabilities