Vulnerability

Philips PIC iX and Efficia CM Series carry a hard-coded key and weak crypto

MedDevice Cyber Staff · Nov 18 · 4 min read · Via CISA ICSMA-21-322-02

CISA published advisory ICSMA-21-322-02 on November 18, 2021, covering three vulnerabilities in the Philips Patient Information Center iX (PIC iX) central station and the Efficia CM Series patient monitors. Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks reported them.

CVE-2021-43548 (CWE-20, CVSS v3 6.5) is improper input validation in PIC iX C.02 and C.03, reachable from an adjacent network with no credentials. Its impact is availability: a temporary interruption of viewing physiological data at the central station.

CVE-2021-43552 (CWE-321, CVSS 6.1) is a hard-coded cryptographic key in PIC iX B.02, C.02 and C.03, which makes encrypted data easier to recover. CVE-2021-43550 (CWE-327, CVSS 5.9) is a broken or risky algorithm protecting traffic between PIC iX C.02 and C.03 and Efficia CM Series revisions A.01 to C.0x and 4.0.

Philips said exploitation does not enable modification of point-of-care devices. The exposure is patient data and the central view of it. A key compiled into every installation is a shared secret across every hospital that runs the product, and one extraction serves them all.

The input validation fix shipped in Q3 2021 as PIC iX C.03.06. Philips planned to remediate the two cryptographic flaws by the end of Q2 2023, a long tail that leaves the interim controls doing the work.

Those controls: keep the patient monitoring network physically or logically isolated from the hospital LAN, filter it to necessary ports and addresses, leave BitLocker Drive Encryption on, sanitize media to NIST SP 800-88 before disposal, and lock down any archive exported with patient information.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update PIC iX to C.03.06 for CVE-2021-43548 and track Philips' remediation of the hard-coded key and weak algorithm, which was planned for the end of Q2 2023. Until then, keep the patient monitoring network isolated from the hospital LAN behind access control lists and leave BitLocker enabled.

Install PIC iX C.03.06. This release fixes the input validation flaw that can interrupt the central station view.
Isolate the monitoring network. Separate it from the hospital LAN physically or logically and allow only necessary ports and IP addresses.
Protect data at rest and in archives. Keep BitLocker enabled, store any archive with patient information under strong access controls, and sanitize media to NIST SP 800-88.
Track the crypto fixes. Follow Philips for the CVE-2021-43552 and CVE-2021-43550 remediation and schedule it when released.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Handles patient data

Contributing

Physiological waveform processing Hospital network Wired network

Patient Information Center iX (PIC iX)

PID-4113 Handles patient data Physiological waveform processing Hospital network

Efficia CM Series

PID-4113

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
qXR-Detect	Qure.ai	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
ProBeam 360 Proton Therapy System v3.0	Varian	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
da Vinci SP Surgical System	Intuitive	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
TipTraQ	Pranaq	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Exposed to the same EMB3D threatTID-329	No feedback feed from manufacturer

Questions & Answers

What is CVE-2021-43552 in Philips Patient Information Center iX?

CVE-2021-43552 is a hard-coded cryptographic key (CWE-321, CVSS v3 6.1) in Philips Patient Information Center iX (PIC iX) B.02, C.02 and C.03 that makes encrypted data easier to recover. CISA advisory ICSMA-21-322-02, published November 18, 2021, says Philips planned a fix by the end of Q2 2023.

Which Efficia CM Series revisions are affected by CVE-2021-43550?

CVE-2021-43550, a broken or risky cryptographic algorithm (CWE-327, CVSS 5.9), affects communications between PIC iX C.02 and C.03 and Philips Efficia CM Series revisions A.01 to C.0x and 4.0, per CISA advisory ICSMA-21-322-02 from November 18, 2021.

Which PIC iX version fixes CVE-2021-43548?

Philips fixed CVE-2021-43548, an input validation flaw (CVSS 6.5) that can interrupt viewing of physiological data at the central station, in PIC iX C.03.06, released in Q3 2021. CISA covered it in ICSMA-21-322-02 on November 18, 2021.

← Back to Vulnerabilities