Vulnerability

Philips ultrasound systems expose an alternate service login that skips authentication

MedDevice Cyber Staff · Jun 25 · 2 min read · Via CISA ICSMA-20-177-01

CISA published advisory ICSMA-20-177-01 on June 25, 2020, for CVE-2020-14477 in Philips ultrasound systems. Affected are Ultrasound ClearVue 3.2 and earlier, CX 5.0.2 and earlier, EPIQ/Affiniti VM5.0 and earlier, Sparq 3.0.2 and earlier, and all versions of Xperius. Philips reported the issue.

The weakness is authentication bypass using an alternate path or channel (CWE-288). An attacker can use an alternate service login path that does not require authentication to view or modify information. The CVSS v3 score is 3.6: local access, high complexity and low privileges, with low confidentiality and integrity impact.

Philips released Ultrasound EPIQ/Affiniti VM6.0 in April 2020 and asked those customers to contact their local Philips service support team for installation. New releases for the other lines were planned. As an interim mitigation, Philips recommends that customers ensure service providers can guarantee installed device integrity during all service and repair operations.

The interim advice points at the exposure. A service path that skips authentication is only as safe as the people holding the service tools.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade EPIQ/Affiniti systems to VM6.0, released in April 2020, through Philips service support. ClearVue, CX, Sparq and Xperius releases were still planned when the advisory published. In the meantime, make sure every service provider can guarantee device integrity during service and repair, since the bypass sits on the service login path.

Install EPIQ/Affiniti VM6.0. Contact the local Philips service support team to schedule the upgrade from VM5.0 or earlier.
Vet service providers. Confirm that anyone servicing ClearVue, CX, Sparq or Xperius systems can guarantee device integrity during service and repair.
Track the planned releases. Watch Philips product security for fixed versions of the remaining lines and apply them when available.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Ultrasound EPIQ/Affiniti

PID-332 User accounts

Fix the class in your product

The firmware does something undocumented: beacons to a hard-coded address, answers a hidden command. As the maker, strip every debug and undocumented path from the release image, remove hard-coded destinations, and require a firmware bill of materials and provenance for every sourced component.

Strip debug paths. Compile diagnostic and undocumented handlers out of the release build and assert their absence.
Remove hard-coded destinations. Every network destination is configured and validated, never baked in.
Demand provenance. Require and verify a firmware bill of materials for sourced blobs.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
LOGIQ e	GE HealthCare	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

What is CVE-2020-14477 in Philips ultrasound systems?

CVE-2020-14477 (CWE-288, CVSS v3 3.6) is an authentication bypass in Philips Ultrasound ClearVue, CX, EPIQ/Affiniti, Sparq and Xperius systems, where an alternate service login path that does not require authentication can be used to view or modify information. CISA disclosed it in ICSMA-20-177-01 on June 25, 2020.

Which Philips EPIQ/Affiniti version fixes CVE-2020-14477?

Philips released Ultrasound EPIQ/Affiniti VM6.0 in April 2020 to address CVE-2020-14477; EPIQ/Affiniti VM5.0 and earlier are affected. Customers install it through their local Philips service support team, per CISA advisory ICSMA-20-177-01.

← Back to Vulnerabilities