Vulnerability

Philips lists connected toothbrushes, a shaver and an espresso machine under SweynTooth BLE flaws

MedDevice Cyber Staff · Feb 20 · 2 min read · Via Philips security advisory

Philips published an advisory on February 20, 2020 on SweynTooth, a family of 12 Bluetooth Low Energy vulnerabilities, CVE-2019-16336, CVE-2019-17519, CVE-2019-17517, CVE-2019-17518, CVE-2019-17520, CVE-2019-19195, CVE-2019-19196, CVE-2019-17061, CVE-2019-17060, CVE-2019-19192, CVE-2019-19193 and CVE-2019-19194.

Philips lists the Diamond Clean Smart and Diamond Clean 9000 connected toothbrushes (HX99), FlexCare Platinum Connected (HX91), Expert Clean (HX96), Sonicare Kids (HX63), the Connected Shaver 7000 (S77xx and S79xx) and Saeco Gran Baristo Avanti espresso machine models.

SweynTooth lives in the BLE chip vendors' software development kits, so one SDK bug ships in every product built on it. Device makers who buy a radio module inherit its bugs.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips lists several connected personal care and coffee products as exposed to SweynTooth. Keep companion apps and product firmware updated where Philips offers updates. Manufacturers should track BLE SDK versions in their SBOMs.

Update companion apps and firmware. Install updates Philips releases for the listed toothbrushes, shaver and espresso machines.
Track BLE SDK versions. Record the BLE chip SDK and version in every product SBOM.
Watch chip vendor advisories. Subscribe to the BLE silicon vendors' security notices.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Home use Mobile app

Sonicare connected power toothbrush

Wireless connectivity

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by SweynTooth?

Philips' February 20, 2020 advisory lists Diamond Clean Smart and Diamond Clean 9000 (HX99), FlexCare Platinum Connected (HX91), Expert Clean (HX96) and Sonicare Kids (HX63) toothbrushes, the Connected Shaver 7000 (S77xx and S79xx) and Saeco Gran Baristo Avanti espresso machines.

What is SweynTooth?

SweynTooth is a family of 12 Bluetooth Low Energy vulnerabilities, including CVE-2019-16336 and CVE-2019-19194, that Philips evaluated across its BLE products in a February 20, 2020 advisory.

← Back to Vulnerabilities