Vulnerability

Philips PageWriter TC cardiographs expose a hard-coded superuser password and unchecked input

MedDevice Cyber Staff · Aug 16 · 3 min read · Via CISA ICSMA-18-228-01

CISA published advisory ICSMA-18-228-01 on August 16, 2018, covering Philips PageWriter TC10, TC20, TC30, TC50 and TC70 cardiographs running software released before May 2018. Philips reported two vulnerabilities.

CVE-2018-14799 (CWE-20, CVSS v3 5.9) is missing input sanitization: the PageWriter does not sanitize data entered by the user, which can lead to buffer overflow or format string bugs. The vector is local, with no privileges or user interaction required.

CVE-2018-14801 is a hard-coded superuser password (CWE-798, CVSS v3 6.1). An attacker with both the superuser password and physical access can open every setting on the device and reset existing passwords. The physical access requirement keeps the score down, yet a cardiograph cart moves between rooms all day and is rarely watched.

Philips told CISA the correcting update is scheduled for the third quarter of 2020. It also flagged that the cardiographs run an operating system the OS vendor no longer supports, and offered additional mitigation advice in its own advisory.

A two-year wait for a fix on a device with a fixed superuser password means the compensating control is physical custody of the cart. Treat the password as already known.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch yet: Philips scheduled the PageWriter TC fix for the third quarter of 2020. Until then, keep cardiograph carts under physical control, follow the additional mitigation advice in the Philips advisory, and plan for the unsupported operating system. Apply the update as soon as Philips releases it.

Control physical access. Store PageWriter carts in staffed or locked areas when not in use, since CVE-2018-14801 needs hands on the device.
Check settings regularly. Review cardiograph configuration and user passwords for unexpected changes during routine biomed checks.
Track the Q3 2020 release. Watch the Philips product security site and schedule the update for every TC10, TC20, TC30, TC50 and TC70 unit.
Ban fixed superuser passwords in design. Service and superuser credentials should be unique per device and rotatable in the field.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Hospital network

PageWriter TC10, TC20, TC30, TC50 and TC70 Cardiographs

PID-3321 PID-23 User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-3321	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
Monaco RTP System	Elekta	Exposed to the same EMB3D threatTID-327	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
da Vinci Xi Surgical System, da Vinci X Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ARIA Radiation Therapy Management	Varian	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Exposed to the same EMB3D threatTID-311	No feedback feed from manufacturer

Questions & Answers

What is CVE-2018-14801 in Philips PageWriter cardiographs?

CVE-2018-14801 is a hard-coded superuser password (CWE-798, CVSS v3 6.1) in Philips PageWriter TC10, TC20, TC30, TC50 and TC70 cardiographs on software before May 2018. Per CISA advisory ICSMA-18-228-01 of August 16, 2018, an attacker with the password and physical access can change all settings and reset existing passwords.

When will Philips patch the PageWriter TC cardiograph vulnerabilities?

Philips scheduled the update correcting CVE-2018-14799 and CVE-2018-14801 in PageWriter TC10, TC20, TC30, TC50 and TC70 cardiographs for the third quarter of 2020, according to CISA advisory ICSMA-18-228-01.

← Back to Vulnerabilities