Skip to main content

Philips Ultrasound Authentication Bypass Vulnerability

An authentication bypass vulnerability has been disclosed in a number of Philips Healthcare ultrasound products. An attacker may exploit this vulnerability to obtain patient information.

Threat ID:
CC-3524
Threat Severity:
Low
Threat Vector:
Vulnerability, Insecure network
Published:
30 June 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

An authentication bypass vulnerability has been disclosed in a number of Philips Healthcare ultrasound products. An attacker may exploit this vulnerability to obtain patient information.

Affected platforms

The following platforms are known to be affected:

Philips Ultrasound ClearVue - Versions 3.2 and earlier

Philips Ultrasound CX - Versions 5.0.2 and earlier

Philips Ultrasound EPIQ/Affiniti - Versions VM5.0 and earlier

Philips Ultrasound Sparq - Version 3.0.2 and earlier

Philips Ultrasound Xperius - All versions

Threat details

Philips Healthcare has released details of an authentication bypass (CWE-288) affecting a number of their ultrasound imaging systems. They claim that a local unauthenticated attacker can exploit this vulnerability to obtain or modify sensitive information.

The vulnerability is a result of the affected systems allowing authentication via alternate paths or channels, or via alternative login services.

Remediation advice

Philips Healthcare has released updates (version VM6.0) for vulnerable Affiniti and EPIQ systems, and is in the process of producing updates for vulnerable ClearVue, CX, and Sparq systems. Affected organisations are encouraged to contact their relevant suppliers to obtain and apply these updates immediately.

Last edited: 19 January 2022 1:39 pm