Vulnerability

Philips MRI 1.5T and 3T let operator accounts export patient data and view system files

MedDevice Cyber Staff · Nov 9 · 3 min read · Via CISA ICSMA-21-313-01

CISA published advisory ICSMA-21-313-01 on November 9, 2021, later revised as Update A, covering three vulnerabilities in Philips MRI 1.5T and MRI 3T systems running software from 5.3 up to but not including 5.8.1. Michael Aguilar of the Secureworks Adversary Group reported them.

All three score CVSS v3 6.2. CVE-2021-26262 is incorrect user management (CWE-286). CVE-2021-26248 is incorrect ownership assignment (CWE-708). CVE-2021-42744 exposes files or directories to parties that should not see them (CWE-552). Together they let someone with operator level access view system configuration and files, and export data, including patient data, to an untrusted environment.

The starting point is an operator account, which on a scanner console is a shared clinical login more often than a named one. That makes the boundary between running scans and reaching the system underneath the control that matters.

Philips released software version 5.8.2 to remediate the issues, referenced by field change order FCO78100619. In the interim it asks users to keep the system within authorized specifications, with physical and logical controls and only allowed personnel near the product.

Operator mode should be a kiosk, and any export path out of it deserves the same audit as a records request.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install Philips MRI software 5.8.2 (FCO78100619) on 1.5T and 3T systems running 5.3 to before 5.8.1. Until then, restrict physical access to the console to allowed personnel and review how operator accounts are issued and what they can export.

Schedule FCO78100619. Have Philips service install software 5.8.2 on affected MRI systems.
Limit console access. Keep only allowed personnel in the vicinity of the scanner console.
Audit data exports. Review exports from operator sessions for destinations outside approved systems.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Role-based access

Contributing

Handles patient data DICOM or image parsing Removable media

MRI 1.5T / MRI 3T

Role-based access Handles patient data

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What do CVE-2021-26262, CVE-2021-26248 and CVE-2021-42744 affect in Philips MRI?

The three CVEs, each CVSS v3 6.2, affect Philips MRI 1.5T and 3T software from 5.3 to before 5.8.1. They let a user with operator level access view system configuration and files and export data, including patient data, to an untrusted environment. CISA published them in ICSMA-21-313-01 on November 9, 2021.

Which Philips MRI software version fixes ICSMA-21-313-01?

Philips MRI 1.5T and 3T software version 5.8.2, referenced by FCO78100619, remediates the vulnerabilities in CISA advisory ICSMA-21-313-01, first published November 9, 2021.

← Back to Vulnerabilities