Vulnerability

Philips IntelliVue WLAN modules accept malicious firmware through a hard-coded FTP password

MedDevice Cyber Staff · Sep 12 · 3 min read · Via CISA ICSMA-19-255-01

CISA published advisory ICSMA-19-255-01 on September 12, 2019, covering two vulnerabilities in the WLAN modules of Philips IntelliVue MP and MX patient monitors. Affected are WLAN Version A with firmware A.03.09 (MP20 to MP90, MP5 and MP5SC) and WLAN Version B with firmware A.01.09 (MP2/X2 and MX800, MX700, MX600). Shawn Loveric of Finite State reported them.

CVE-2019-13530 (CWE-259, CVSS v3 6.4) is a hard-coded password: an attacker can use it to log in over FTP and upload malicious firmware. CVE-2019-13534 (CWE-494, CVSS 6.4) closes the loop, since the module runs downloaded code without verifying its origin or integrity.

The impact Philips described is corrupted WLAN firmware and disrupted data flow over the wireless module, producing an inoperative condition alert at the monitor and the Central Station. The vector needs adjacent network access and high privileges, which in practice means the wireless network the monitors join.

WLAN Version B is obsolete, and Philips recommends replacing it with the Version C module, whose current firmware B.00.31 is not vulnerable. For Version A, Philips estimated a software patch on InCenter by the end of 2019. Meanwhile, wireless access should require authentication such as WPA2, and a firewall rule should restrict FTP on the wireless network.

A hard-coded password plus unsigned firmware is two mistakes, and fixing either one breaks the attack.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Replace IntelliVue WLAN Version B modules with Version C (firmware B.00.31), and install the Philips patch for Version A modules from InCenter. Until then, require WPA2 or stronger authentication on the monitor wireless network and block FTP to the monitors with a firewall rule.

Swap Version B for Version C. Version B is obsolete; Version C with firmware B.00.31 is not vulnerable.
Patch Version A modules. Install the Philips software patch for WLAN Version A from InCenter.
Block FTP on the wireless network. Add a firewall rule restricting FTP access to the monitors.
Require wireless authentication. Use WPA2 or stronger so only authorized devices join the monitor network.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity Field-updatable firmware

Contributing

Physiological waveform processing Hospital network

IntelliVue WLAN

PID-3321 PID-271 Wireless connectivity Field-updatable firmware

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2019-13530 in Philips IntelliVue WLAN modules?

CVE-2019-13530 (CWE-259, CVSS v3 6.4) is a hard-coded password in Philips IntelliVue WLAN Version A firmware A.03.09 and Version B firmware A.01.09 that lets an attacker log in via FTP and upload malicious firmware. CISA published it in ICSMA-19-255-01 on September 12, 2019.

Is IntelliVue WLAN Version C affected by CVE-2019-13530?

No. CISA advisory ICSMA-19-255-01, published September 12, 2019, says Philips IntelliVue WLAN Version C with firmware B.00.31 is not vulnerable. Philips recommends replacing obsolete Version B modules with Version C.

← Back to Vulnerabilities