Philips IntelliVue MX40 B.06.18 data processing

Summaryinfo

A vulnerability was found in Philips IntelliVue MX40 B.06.18. It has been classified as critical. This affects an unknown function. Performing a manipulation results in data processing. This vulnerability was named CVE-2017-9657. The attack needs to be approached within the local network. There is no available exploit.

Detailsinfo

A vulnerability was found in Philips IntelliVue MX40 B.06.18. It has been classified as critical. This affects an unknown code block. The manipulation with an unknown input leads to a data processing vulnerability. CWE is classifying the issue as CWE-19. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX40 is not connected or associated to the central monitor, and thus should be operating in local monitoring mode (local audio-on, screen-on), but the MX40 WLAN itself can instead still be operating in telemetry mode (local audio-off, screen-off). If a patient experiences an alarm event and clinical staff expects the MX40 to provide local alarming when it is not available from the local device, a delay of treatment can occur. CVSS v3 base score: 6.5, CVSS vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Philips has released software update, Version B.06.18, to fix the improper cleanup on thrown exception vulnerability, and implement mitigations to reduce the risk associated with the improper handling of exceptional conditions vulnerability. The software update implements messaging and alarming on the MX40 and at the central monitoring station, when the MX40 disconnects from the access point.

The bug was discovered 09/12/2017. The weakness was presented 04/30/2018 (Website). The advisory is shared at usa.philips.com. This vulnerability is uniquely identified as CVE-2017-9657 since 06/14/2017. Access to the local network is required for this attack. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 230 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100813†). See VDB-109655, VDB-114821, VDB-115070 and VDB-115071 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Philips

Name

• IntelliVue MX40

Version

• B.06.18

License

• commercial

Website

• Vendor: https://www.philips.ch/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion