Vulnerability

Philips IntelliVue and Avalon monitors let an unauthenticated attacker read and write memory

MedDevice Cyber Staff · Jun 5 · 3 min read · Via CISA ICSMA-18-156-01

CISA published advisory ICSMA-18-156-01 on June 5, 2018, covering three vulnerabilities in Philips patient monitors. Affected lines are the IntelliVue MP Series (including MP2, X2, MP30, MP50, MP70, NP90 and MX700/800) at Rev B to M, the IntelliVue MX400 to MX550 at Rev J to M (X3 and MX100 at Rev M only), and the Avalon FM20, FM30, FM40 and FM50 fetal/maternal monitors at F.0, G.0 and J.3. Oran Avraham of Medigate reported the flaws.

CVE-2018-10597 (CWE-287, CVSS v3 8.3) lets an unauthenticated attacker write memory at an attacker-chosen address on a monitor in the same subnet. CVE-2018-10599 (CWE-200, CVSS 6.4) gives the same attacker read access to memory. CVE-2018-10601 (CWE-121, CVSS 8.2) is a stack-based buffer overflow in an exposed echo service, which copies an attacker-sent buffer to the stack with no boundary checks.

All three vectors are adjacent network with high attack complexity, so the attacker needs a foothold on the monitor's subnet first. Write-what-where access is about as complete as device compromise gets once that foothold exists. CISA's risk evaluation names memory read and write and a denial of service through a system restart, which could delay diagnosis and treatment.

Philips said it would provide a remediation patch for specific supported versions and an upgrade path for all versions, and would communicate service options to the installed base. Field change and service bulletin information is distributed through the Philips InCenter portal.

A bedside monitor that answers memory requests from any host on its subnet makes the clinical network segment the only real control. Treat the monitor VLAN as part of the device.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips committed to a remediation patch for specific supported versions of the IntelliVue and Avalon monitors and an upgrade path for all versions. Operators should pull the field change and service bulletin for their revisions from Philips InCenter and schedule the upgrade. Until then, the monitor subnet is the boundary that keeps an unauthenticated attacker away from device memory.

Get the Philips service bulletin. Look up the field change for each monitor revision in the Philips InCenter portal and plan the patch or upgrade.
Isolate the monitor subnet. Keep IntelliVue and Avalon monitors on a dedicated segment so no general-purpose host shares their subnet.
Watch for unexpected restarts. A monitor that reboots without cause may be the target of the echo service overflow and should be reported to Philips.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

IntelliVue Patient Monitors

PID-41 PID-331 Hospital network

Avalon Fetal/Maternal Monitors

PID-331

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same FDA device type	No feedback feed from manufacturer
CARESCAPE B450, E-musb	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
Monitor B125, Monitor B105	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
Next Generation NetKonnect	Nihon Kohden	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

What is CVE-2018-10597 in Philips IntelliVue patient monitors?

CVE-2018-10597 is an improper authentication flaw (CVSS v3 8.3) in Philips IntelliVue MP and MX patient monitors and Avalon FM20 to FM50 fetal/maternal monitors that lets an unauthenticated attacker on the same subnet write memory at an attacker-chosen address. CISA disclosed it in advisory ICSMA-18-156-01 on June 5, 2018.

Is there a patch for the Philips IntelliVue and Avalon monitor vulnerabilities in ICSMA-18-156-01?

Philips said it would provide a remediation patch for specific supported versions and an upgrade path for all versions of the affected IntelliVue and Avalon monitors, covering CVE-2018-10597, CVE-2018-10599 and CVE-2018-10601. Field change and service bulletin details are available through the Philips InCenter portal.

← Back to Vulnerabilities