CISA published advisory ICSMA-18-312-01 on November 8, 2018, covering Philips iSite PACS and IntelliSpace PACS, all versions. An anonymous party reported the issue, with Philips also credited. It is CVE-2018-17906 (CWE-521), with a CVSS v3 base score of 6.3.
The advisory says default credentials and no authentication within third party software may allow an attacker to compromise a component of the system. Exploitation needs adjacent network access but no privileges and no user interaction, and CISA says an attacker with local network access could affect the confidentiality, integrity and availability of that component.
A PACS is assembled from off-the-shelf parts, and each part can arrive with its own accounts and admin services. When a bundled default is never changed, the weakest login in the archive belongs to software the hospital may not know it runs.
Philips named no fixed version. It recommends running IntelliSpace PACS in a managed service environment with a virtual private network, firewall isolation from other networks and no Internet access, plus its automated antivirus and monthly recurring patch program for approved operating system and application patches. The advisory also notes the iSite 3.6 platform is at end of life and end of service.
For iSite 3.6 sites, segmentation is now the only control left, so a replacement plan belongs on the budget.