Vulnerability

Philips Interoperability Solution XDS can expose LDAP system credentials in cleartext

MedDevice Cyber Staff · Jun 24 · 2 min read · Via CISA ICSMA-21-175-01

CISA published advisory ICSMA-21-175-01 on June 24, 2021, covering a single vulnerability in Philips Interoperability Solution XDS. Affected releases run from 2.5 to 3.11 and from 2018-1 to 2021-1. Philips reported the issue itself.

CVE-2021-32966 is cleartext transmission of sensitive information (CWE-319, CVSS v3 3.7). It only applies when the product is configured to use LDAP via TLS and the domain controller returns LDAP referrals. In that setup an attacker with access to the network channel can read the LDAP system credentials.

The low score comes from the vector: high attack complexity, no integrity or availability impact. The asset at stake is still a directory service account, and directory accounts tend to open more doors than the application that holds them.

The advisory lists no fixed version. Philips directs users to its regional service support at 1-800-722-9377 and to its product security site for installation-specific guidance.

Check how your domain controllers handle referrals before you trust the TLS checkbox on an integration server.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Contact Philips service for installation-specific guidance on Interoperability Solution XDS, since the advisory names no fixed version. Review whether the XDS components use LDAP via TLS against domain controllers that return referrals, and rotate the LDAP system account if they do.

Confirm the LDAP configuration. Check whether XDS uses LDAP via TLS and whether your domain controllers return LDAP referrals, the two conditions the flaw needs.
Rotate the LDAP system account. Treat the service account password as exposed if both conditions were true, and limit what that account can do in the directory.
Contact Philips service. Ask regional service support for the remediation that applies to your XDS release.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Hospital network Wired network

Interoperability Solution XDS

PID-41 User accounts

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2021-32966 in Philips Interoperability Solution XDS?

CVE-2021-32966 is a cleartext transmission flaw (CWE-319, CVSS v3 3.7) in Philips Interoperability Solution XDS 2.5 to 3.11 and 2018-1 to 2021-1. When the product uses LDAP via TLS and the domain controller returns LDAP referrals, an attacker on the network channel can read LDAP system credentials. CISA published it as ICSMA-21-175-01 on June 24, 2021.

Is there a patch for Philips Interoperability Solution XDS CVE-2021-32966?

CISA advisory ICSMA-21-175-01, published June 24, 2021, does not name a fixed version of Philips Interoperability Solution XDS. Philips asks users to contact its regional service support at 1-800-722-9377 for guidance on their installation.

← Back to Vulnerabilities