Vulnerability

Philips IntelliBridge Enterprise writes plaintext EMR credentials into its transaction logs

MedDevice Cyber Staff · Jun 11 · 2 min read · Via CISA ICSMA-20-163-01

CISA published advisory ICSMA-20-163-01 on June 11, 2020, for Philips IntelliBridge Enterprise (IBE) Version B.12 and prior. The affected integrations are IBE with EarlyVue VS30, IntelliVue Guardian (IGS) and SureSigns VS4. Indiana University Health reported the issue.

Those products send unencrypted user credentials to IBE as part of the handshake or authentication with enterprise systems. IBE logs them as payload in its transaction logs. CVE-2020-12023 (CWE-532) has a CVSS v3 base score of 2.0, because reading the logs requires administrative privileges on the login-based web portal and adjacent network access.

The low score hides the consequence. CISA says exploitation could give an attacker credentials to the hospital's clinical information systems, the EMR, so one compromised IBE administrator account turns into EMR access.

Philips plans to release IBE B.13 by the end of Q4 2020, which stops logging plaintext credentials, and has published interim mitigations. Integration engines collect secrets from every system they touch; scrub credentials from logs at the point of capture.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade to IntelliBridge Enterprise B.13 when Philips releases it (planned by the end of Q4 2020); it stops logging plaintext credentials. Until then, limit who holds IBE administrative access, review existing transaction logs for stored credentials, and rotate any EMR credentials that appear in them.

Plan the B.13 upgrade. Schedule IntelliBridge Enterprise B.13 as soon as Philips releases it.
Restrict IBE admin access. Cut the IBE administrative portal down to the people who maintain the interfaces.
Rotate exposed credentials. Change any EMR credentials found in existing IBE transaction logs.
Redact secrets at capture. Mask credential fields before an integration engine writes payloads to any log.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Web interface Hospital network

IntelliBridge Enterprise (IBE)

PID-34 PID-311 Web interface User accounts

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Embryo Predict	Alife Health	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
MOSAIQ Oncology Information System	Elekta	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
VELYS Robotic-Assisted Solution	Johnson & Johnson MedTech	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
ASSURE Wearable ECG	Kestra Medical Technologies	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
InPen System App (MMT-8060 (iOS), MMT-8061	Medtronic	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Same property (MITRE EMB3D)PID-34	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
ID NOW COVID-19 2.0	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer

9 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-12023 in Philips IntelliBridge Enterprise?

CVE-2020-12023 (CWE-532, CVSS v3 2.0) means Philips IntelliBridge Enterprise B.12 and prior writes unencrypted user credentials from EarlyVue VS30, IntelliVue Guardian and SureSigns VS4 integrations into its transaction logs. An administrator could read EMR credentials from those logs, per CISA advisory ICSMA-20-163-01 from June 11, 2020.

When will Philips fix the IntelliBridge Enterprise credential logging issue?

Philips planned IntelliBridge Enterprise release B.13 by the end of Q4 2020 to stop logging plaintext credentials (CVE-2020-12023), per CISA advisory ICSMA-20-163-01. Interim mitigations apply until then.

← Back to Vulnerabilities

Key Facts

Target Product: IntelliBridge Enterprise (IBE) B.12 and prior; integrations with EarlyVue VS30, IntelliVue Guardian (IGS), SureSigns VS4 (Philips)
Device Type: Clinical device integration engine
Material: IntelliBridge Enterprise ≤ B.12, fixed in B.13
Component: Web Application
Interface: TCP
Dataflows: EarlyVue VS30, IntelliVue Guardian and SureSigns VS4 to IntelliBridge Enterprise (unencrypted user credentials during ha; IntelliBridge Enterprise to transaction logs (credentials logged as payload)
Assets: plaintext user credentials sent by EarlyVue VS30, IntelliVue Guardian and SureSigns VS4 (Credentials); IBE transaction logs containing credentials (Log Data); credentials to hospital clinical information systems / EMR (Credentials)
Advisory: ICSMA-20-163-01
CVE: CVE-2020-12023
CVSS: 2.0
Severity: Medium
Disclosed: Jun 11, 2020
Source: CISA ICSMA-20-163-01

Sources

Philips: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Philips