Vulnerability

Philips IntelliSpace Cardiovascular and Xcelera store credentials in cleartext

MedDevice Cyber Staff · Nov 14 · 3 min read · Via CISA ICSMA-17-318-01

CISA published advisory ICSMA-17-318-01 on November 14, 2017, covering a stored credential flaw in Philips IntelliSpace Cardiovascular and Xcelera. Affected versions are IntelliSpace Cardiovascular 2.3.0 and earlier and Xcelera R4.1L1 and earlier. Philips reported the vulnerability itself.

CVE-2017-14111 (CWE-522, insufficiently protected credentials) carries a CVSS v3 base score of 7.2. Credentials sit in cleartext in system files.

The vector explains the score. Exploitation needs high privileges (PR:H), but it is network reachable with low complexity, and the confidentiality, integrity and availability impacts are all high. An attacker who already holds an elevated account can read the stored credentials and reach patient health information, system resources and connected assets.

Both products are cardiac image and information management systems, so the stored credentials are a path from one compromised account into the wider cardiology workflow. Cleartext secrets on disk turn a contained intrusion into lateral movement.

Philips said it was producing software hotfix updates for all IntelliSpace Cardiovascular and latest Xcelera versions. Some were available on request, and the rest were expected by the end of 2017. Philips also opened a voluntary medical device correction aligned with field change order FCO83000202, issued as the IntelliSpace Cardiovascular updates became available.

A self-reported flaw with a field change order attached is how coordinated disclosure is supposed to look. Credentials on disk still belong in a protected store, hashed or encrypted, from day one.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Request the Philips software hotfix for IntelliSpace Cardiovascular 2.3.0 and earlier and Xcelera R4.1L1 and earlier; some were available on request, others were due by the end of 2017 under field change order FCO83000202. Until the hotfix is in, limit who holds elevated accounts on these systems. Contact local Philips service support for installation specifics.

Request the Philips hotfix. Contact local or regional Philips service support for the IntelliSpace Cardiovascular or Xcelera hotfix tied to FCO83000202.
Cut back elevated accounts. Exploitation needs high privileges, so reduce administrative accounts on the servers and review who holds them.
Rotate exposed credentials. After patching, change any credentials that were stored in cleartext system files.
Store secrets protected. Keep service and user credentials in an encrypted or hashed store rather than plain system files.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Handles patient data DICOM or image parsing Hospital network

IntelliSpace Cardiovascular

User accounts Handles patient data DICOM or image parsing

Xcelera

User accounts Handles patient data DICOM or image parsing

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
LOGIQ e	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer

Questions & Answers

What is CVE-2017-14111 in Philips IntelliSpace Cardiovascular?

CVE-2017-14111 (CWE-522, CVSS v3 7.2) means credentials are stored in cleartext in system files of Philips IntelliSpace Cardiovascular 2.3.0 and earlier and Xcelera R4.1L1 and earlier. CISA published advisory ICSMA-17-318-01 on November 14, 2017; an attacker with elevated privileges could reach patient health information and connected assets.

Is there a fix for the Philips Xcelera cleartext credential vulnerability?

Yes. Philips said it was producing software hotfix updates for all IntelliSpace Cardiovascular and latest Xcelera versions for CVE-2017-14111, some available on request and the rest expected by the end of 2017, under field change order FCO83000202, per CISA advisory ICSMA-17-318-01.

← Back to Vulnerabilities