PT-2018-8518 · Philips · Philips Intellivue Mx40

Published 2018-04-30 · Updated 2019-10-09 · CVE-2017-9657

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Philips IntelliVue MX40 Version B.06.18

Description The issue occurs under specific 802.11 network conditions, where a partial re-association of the Philips IntelliVue MX40 WLAN monitor to the central monitoring station is possible. This can lead to a situation where the central monitoring station indicates the MX40 is not connected, but the MX40 WLAN itself remains in telemetry mode. As a result, if a patient experiences an alarm event, a delay of treatment can occur because clinical staff may expect local alarming from the MX40 when it is not available.

Recommendations For Philips IntelliVue MX40 Version B.06.18, apply the software update released by Philips to fix the issue and implement mitigations. The update includes messaging and alarming on the MX40 and at the central monitoring station when the MX40 disconnects from the access point.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-460

Related Identifiers

CVE-2017-9657

Affected Products

Philips Intellivue Mx40

References · 5

• https://osv.dev/vulnerability/CVE-2017-9657 · Vendor Advisory
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9657 · Security Note
• http://securityfocus.com/bid/100813 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-255-01 · Note