Skip to main content

Philips IntelliBridge Hub Vulnerabilities

Two vulnerabilities in patient care device connectivity and interoperability solution

Threat ID:
CC-3981
Threat Severity:
Low
Published:
23 November 2021 3:18 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Two vulnerabilities in patient care device connectivity and interoperability solution

Affected platforms

The following platforms are known to be affected:

Versions: EC 40 Hub, C.00.04 and earlier, EC 80 Hub, C.00.04 and earlier

Philips IntelliBridge System

Threat details

Introduction

Philips Healthcare has released details of two vulnerabilities in the IntelliBridge EC 40 and EC 80 Hub. The IntelliBridge Hub is intended to transfer medical device data from one format to another according to preset specifications. It performs data transfer without controlling or altering the function or parameters of any connected medical devices. It is not intended for use in connection with active patient monitoring. 

The vulnerabilities are a result of using hard-coded credentials and an authentication bypass using an alternate path or channel.  With successful exploitation of these vulnerabilities, an attacker could gain access to the IntelliBridge Hub and execute software, modify system configurations, or view/update files, including unidentifiable patient data.

Remediation advice

Philips has confirmed that it plans to release an update to remediate these vulnerabilities by the end of Q4 2021. 

As an interim mitigation to these vulnerabilities, Philips recommends the following:

  • Users should operate all Philips deployed and supported products within Philips authorised specifications, including Philips approved software, software configuration, system services, and security configuration.
  • The medical device network should be logically or physically isolated from the hospital network as specified in the Philips Patient Monitoring System Security for Clinical Networks guide, available on Philips InCenter. There is no clinical requirement for these devices to communicate outside of the Philips clinical network.

Affected organisations should review the Philips IntelliBridge EC40 and EC80 (2021 November 18) security advisory and contact their relevant suppliers to apply updates as they become available.

Last edited: 23 November 2021 3:37 pm