Vulnerability

Philips IntelliBridge EC 40 and EC 80 hubs carry hard-coded credentials and an unauthenticated path

MedDevice Cyber Staff · Nov 18 · 3 min read · Via CISA ICSMA-21-322-01

CISA published advisory ICSMA-21-322-01 on November 18, 2021, covering two vulnerabilities in the Philips IntelliBridge EC 40 and EC 80 hubs, versions C.00.04 and prior. Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks reported them.

CVE-2021-32993 (CWE-798) is hard-coded credentials, such as a password or cryptographic key, used for inbound authentication, outbound communication or encryption of internal data. CVE-2021-33017 (CWE-288) is an alternate path: the standard access path requires authentication, but another channel into the hub does not. Both score 8.1 under CVSS v3, with an adjacent network vector, no privileges and high integrity and availability impact.

An attacker who gets in could execute software, modify system configuration, or view and update files, including unidentifiable patient data. Philips notes the hub only transfers medical device data from one format to another, without controlling or altering connected devices, and is not intended for active patient monitoring. If data stops arriving from the hub, the PIC iX Central Station raises a notification and users are told to refer to the source device.

Philips planned a new release to remediate both flaws by the end of Q4 2021 and recommended interim mitigations until then. The same hubs drew CISA advisory ICSMA-19-318-01 in November 2019 for weak SSH ciphers, so this is the second round of access fixes for the product line.

A hub with one authenticated door and one open door has no authentication, so inventory every listening service before release.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips planned a fixed IntelliBridge EC 40 and EC 80 release by the end of Q4 2021; until it is installed, versions C.00.04 and prior have no patch and need Philips' interim mitigations. Both flaws need adjacent network access, so isolate the hubs. Contact Philips service support for product-specific guidance.

Apply Philips' interim mitigations. Follow the vendor guidance in ICSMA-21-322-01 for hubs at C.00.04 and prior.
Isolate the hubs. Both flaws need adjacent network access, so restrict the hub segment to the devices and central station it serves.
Install the fixed release. Move to the remediated firmware once Philips ships it.
Close every unauthenticated channel. Device makers should require the same authentication on every interface and remove shared built-in credentials.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data Hospital network

IntelliBridge EC 40 and EC 80 Hub

PID-331 PID-332 Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2021-32993 and CVE-2021-33017 in the Philips IntelliBridge EC 40 and EC 80?

CVE-2021-32993 is hard-coded credentials and CVE-2021-33017 is an alternate path that skips authentication in Philips IntelliBridge EC 40 and EC 80 hubs, versions C.00.04 and prior. Both score CVSS 8.1, per CISA advisory ICSMA-21-322-01 of November 18, 2021.

Is there a fix for the Philips IntelliBridge EC 40/EC 80 hard-coded credential flaw?

Philips planned a new IntelliBridge EC 40 and EC 80 release remediating CVE-2021-32993 and CVE-2021-33017 by the end of Q4 2021 and recommended interim mitigations until then, per CISA advisory ICSMA-21-322-01.

Can the Philips IntelliBridge EC 40 and EC 80 vulnerabilities affect patient monitoring?

Philips says the IntelliBridge EC 40 and EC 80 hub only transfers medical device data between formats, does not control connected devices and is not intended for active patient monitoring; if data stops, the PIC iX Central Station notifies users, per CISA advisory ICSMA-21-322-01.

← Back to Vulnerabilities