Vulnerability

Philips IntelliBridge EC40 and EC80 hubs allow weak SSH ciphers

MedDevice Cyber Staff · Nov 14 · 2 min read · Via CISA ICSMA-19-318-01

CISA published advisory ICSMA-19-318-01 on November 14, 2019, covering CVE-2019-18241 in the Philips IntelliBridge EC40 and EC80 hubs, all versions. The Medical Technology Solutions team of NewYork-Presbyterian Hospital reported it.

The SSH server on the hubs is configured to allow weak ciphers (CWE-326, Inadequate Encryption Strength). An attacker with access to the network can capture and replay a session and gain unauthorized access to the hub. The CVSS v3 score is 6.3, with an adjacent network vector and no privileges required.

Inside the hub, the advisory says an attacker could execute software, modify system configuration, or view and update files, including unidentifiable patient data. The report came from a hospital's own clinical engineering team rather than an outside research firm.

Philips planned a new release to remediate the vulnerability by the end of Q3 2020 and recommended interim mitigations, with details on its InCenter portal. Users with questions should contact Philips service support. Cipher lists on embedded SSH servers age badly, so the allowed set needs a review at every release.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips planned a fixed IntelliBridge EC40/80 release by the end of Q3 2020; until it is installed there is no patch, only interim mitigations Philips publishes through InCenter. The attack needs network access to the hub, so keep the hubs on a segmented clinical network. Contact Philips service support for the specific configuration.

Apply the Philips interim mitigations. Philips lists them for the EC40 and EC80 through its InCenter portal and service support.
Segment the hubs. Exploitation needs adjacent network access, so restrict which hosts can reach the hubs' SSH service.
Install the fixed release. Move to the remediated IntelliBridge release once Philips ships it.
Pin a strong cipher set. Device makers should allow only current SSH ciphers and key exchanges and review that list at every release.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access

Contributing

Handles patient data

IntelliBridge EC40/80 Hub

PID-41 PID-4113 Remote access Handles patient data

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer

Questions & Answers

What is CVE-2019-18241 in the Philips IntelliBridge EC40 and EC80?

CVE-2019-18241 (CVSS 6.3) means the SSH server on Philips IntelliBridge EC40 and EC80 hubs, all versions, allows weak ciphers, so an attacker on the network could capture and replay a session to gain unauthorized access. CISA covered it in advisory ICSMA-19-318-01 on November 14, 2019.

When will Philips fix the IntelliBridge EC40/80 SSH weak cipher flaw?

Philips planned a new IntelliBridge EC40/80 release remediating CVE-2019-18241 by the end of Q3 2020 and provided interim mitigations in the meantime, per CISA advisory ICSMA-19-318-01.

Who reported the Philips IntelliBridge EC40/80 vulnerability?

The Medical Technology Solutions team of NewYork-Presbyterian Hospital reported CVE-2019-18241 in the Philips IntelliBridge EC40 and EC80 hubs, per CISA advisory ICSMA-19-318-01 of November 14, 2019.

← Back to Vulnerabilities