Vulnerability

Philips IntelliSpace Portal 7.0 and 8.0 carry 35 vulnerabilities, led by remote code execution

MedDevice Cyber Staff · Feb 27 · 4 min read · Via CISA ICSMA-18-058-02

CISA published advisory ICSMA-18-058-02 on February 27, 2018, listing 35 vulnerabilities in Philips IntelliSpace Portal (ISP), all versions of 7.0.x and 8.0.x. Philips is credited with reporting them. Three Philips-specific CVEs carry a CVSS v3 base score of 9.8: CVE-2018-5474, an input validation flaw that could let a remote attacker execute code or crash the application; CVE-2018-5472, insecure Windows permissions; and CVE-2018-5468, a remote desktop access issue.

Most of the list is inherited from Microsoft Windows. Twenty entries are SMBv1 server flaws from 2017, among them CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146 and CVE-2017-0148 at CVSS 8.1, plus SMB denial of service and information disclosure bugs. CVE-2017-0199 (Office and WordPad code execution) and CVE-2005-1794 (an RDP private key that enables man-in-the-middle attacks) are also on it.

The transport layer is weak as well. CVE-2018-5462, CVE-2018-5464 and CVE-2018-5466 (CVSS 7.5 each) cover incorrect hostname, untrusted and self-signed SSL certificates. The legacy cipher findings follow: BEAST (CVE-2011-3389), MD5 certificate signatures (CVE-2004-2761), POODLE (CVE-2014-3566) and Sweet32 (CVE-2016-2183).

Two more are local or design issues. CVE-2018-5470 (CVSS 7.8) is an unquoted search path that lets an authorized local user escalate privileges. CVE-2018-5454 notes that code debugging methods are enabled, which could allow remote code execution at runtime.

CISA's risk summary covers the full range: information disclosure, man-in-the-middle attacks, denial of service and arbitrary code execution. Philips said its evaluation of operating system security patches was ongoing, and that tested patches and mitigating controls are posted on its InCenter portal for ISP customers.

IntelliSpace Portal shows what happens when a clinical application rides on a general-purpose Windows build that is patched on the manufacturer's schedule rather than Microsoft's. The SMBv1 entries were public the year before, so the patch qualification lag is the risk to manage.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Pull the tested operating system patches and mitigating controls for IntelliSpace Portal 7.0.x and 8.0.x from Philips InCenter and apply them. Until they are in place, keep ISP servers off the internet, behind firewalls and isolated from business networks, as CISA recommends. Use a VPN for any remote access and close RDP and SMB to everything except the hosts that need them.

Apply InCenter patches. Download the Philips-qualified patches and mitigating controls for each ISP 7.0.x and 8.0.x installation from InCenter.
Close SMB and RDP exposure. Block SMBv1 and remote desktop to ISP servers from all but named administrative hosts.
Isolate the server. Place ISP behind a firewall, separated from business networks and unreachable from the internet.
Shorten OS patch qualification. Manufacturers shipping Windows-based clinical software need a qualification path measured in weeks for critical OS fixes.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Remote access Hospital network Off-the-shelf software

IntelliSpace Portal

PID-23 PID-22 PID-41 Named operating system Remote access

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

How many vulnerabilities affect Philips IntelliSpace Portal 7.0 and 8.0?

CISA advisory ICSMA-18-058-02, published February 27, 2018, lists 35 vulnerabilities in all Philips IntelliSpace Portal 7.0.x and 8.0.x versions. The most severe, CVE-2018-5474, CVE-2018-5468 and CVE-2018-5472, carry CVSS v3 scores of 9.8, and many others are inherited Windows SMBv1 and TLS weaknesses.

Where do I get patches for Philips IntelliSpace Portal CVE-2018-5474?

Philips posts tested operating system patches and mitigating controls for IntelliSpace Portal 7.0.x and 8.0.x on its InCenter portal, per CISA advisory ICSMA-18-058-02. Customers with installation-specific questions are directed to their local Philips service support team.

Does Philips IntelliSpace Portal use SMBv1?

CISA advisory ICSMA-18-058-02 lists Windows SMBv1 server vulnerabilities, including CVE-2017-0143, CVE-2017-0144 and CVE-2017-0145, as affecting Philips IntelliSpace Portal 7.0.x and 8.0.x.

← Back to Vulnerabilities