Vulnerability

Philips IntelliSpace Cardiovascular reuses sessions in EMR kiosk mode

MedDevice Cyber Staff · Jan 25 · 2 min read · Via CISA ICSMA-18-025-01

CISA published advisory ICSMA-18-025-01 on January 25, 2018, covering CVE-2018-5438 in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and prior. The flaw is insufficient session expiration (CWE-613), scored 6.7 under CVSS v3. Philips reported it.

The condition is specific. ISCV has to be used together with an Electronic Medical Record (EMR) system, running in KIOSK mode for multiple users with Windows authentication. In that setup an attacker could reuse the session of a previously logged in user, gaining access to patient health information and potentially modifying it.

CISA says the vulnerability is not exploitable remotely, and the vector requires local access and user interaction. On a shared clinical workstation that bar is low: the next person at the keyboard inherits whoever came before.

Philips is adding a configuration option to ISCV 3.1 that lets the EMR connection in KIOSK mode run without Windows authentication, and said it would release that version in the coming months. A shared kiosk needs a session that dies when the user walks away.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips is adding an option in IntelliSpace Cardiovascular 3.1 to stop using Windows authentication for the EMR connection in KIOSK mode. Until a site moves to 3.1, the exposure exists only in the EMR plus KIOSK plus Windows authentication setup on 2.3.0 and prior. Sites in that configuration should contact Philips service support.

Check the deployment mode. Identify ISCV 2.3.0 and prior installs that run in KIOSK mode with an EMR and Windows authentication.
Plan the move to ISCV 3.1. Version 3.1 adds the option to not use Windows authentication for the EMR connection in KIOSK mode.
Expire sessions on shared stations. Software makers should end a session on logoff or user switch so a shared kiosk never hands one user's access to the next.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data

IntelliSpace Cardiovascular

PID-332 User accounts Handles patient data

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2018-5438 in Philips IntelliSpace Cardiovascular?

CVE-2018-5438 is an insufficient session expiration flaw (CVSS 6.7) in Philips IntelliSpace Cardiovascular 2.3.0 and prior. When ISCV runs with an EMR in KIOSK mode using Windows authentication, an attacker could reuse a previous user's session and reach patient health information. CISA covered it in ICSMA-18-025-01 on January 25, 2018.

Is there a fix for the Philips IntelliSpace Cardiovascular session flaw CVE-2018-5438?

Philips is adding a configuration option to IntelliSpace Cardiovascular 3.1 that allows not using Windows authentication when communicating with an EMR in KIOSK mode, per CISA advisory ICSMA-18-025-01. Users with questions should contact their local Philips service support team.

← Back to Vulnerabilities