Skip to main content

Philips e-Alert Vulnerability

Philips e-Alert, an MRI system monitoring platform, is missing authentication for critical system functionality, which may allow an attacker to remotely shutdown the system

Threat ID:
CC-4068
Threat Severity:
Low
Published:
30 March 2022 1:29 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Philips e-Alert, an MRI system monitoring platform, is missing authentication for critical system functionality, which may allow an attacker to remotely shutdown the system

Affected platforms

The following platforms are known to be affected:

Versions: 2.7 and earlier

Philips e-Alert MRI monitoring solution

Threat details

Introduction

Philips have announced a vulnerability in e-Alert, an MRI system monitoring platform. The vulnerability exists because the software does not perform any authentication for critical system functionality. An unauthenticated attacker within the same subnet could exploit this vulnerability to issue a remote shutdown command, leading to a denial-of-service of the e-Alert hardware solution.

Remediation advice

To restore system operation, the e-Alert hardware solution needs to be manually powered on again.

Philips plans a new release to remediate this vulnerability before July 2022. As an interim mitigation to this vulnerability, Philips recommends the following:

  • Users should operate all Philips deployed and supported products within Philips authorised specifications, including physical and logical controls. Only authorised personnel should be permitted to access the network and the devices connected to it.

Users with questions about their specific e-Alert product should contact a Philips service support team or regional service support. Users can also reference the Philips e-Alert Hardware Advisory (2022 March 29) for more details.

CISA recommends users take defensive measures to minimise the risk of exploitation of this vulnerability. Specifically, users should:

  • Minimise network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolate them from the business network.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognising VPNs may have vulnerabilities and should be updated to the most current version available. Also recognise VPN is only as secure as its connected devices.

Last edited: 30 March 2022 2:45 pm