Security restrictions bypass vulnerabilities in Philips PageWriter

Published: 2018-08-20 16:51:41

Severity	Low
Patch available	NO
Number of vulnerabilities	2
CVE ID	CVE-2018-14799 CVE-2018-14801
CVSSv3	5.3 [CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:W/RC:C] 5.5 [CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:W/RC:C]
CWE ID	CWE-120 CWE-798
Exploitation vector	Local
Public exploit	N/A
Vulnerable software	PageWriter TC70 PageWriter TC50 PageWriter TC30 PageWriter TC20 PageWriter TC10
Vulnerable software versions	PageWriter TC70 - PageWriter TC50 - PageWriter TC30 - PageWriter TC20 - PageWriter TC10 -
Vendor URL	Philips

Security Advisory

1) Buffer overflow

Description

The vulnerability allows a local unauthenticated attacker to bypass security restrictions on the target system.

The weakness exists due to boundary error or format string when handling malicious input. A local attacker can supply specially crafted data and trigger memory corruption to access and modify settings on the device.

Remediation

Philips plans an update to correct these issues in the release scheduled for mid-year 2019.

Philips has also provided the following information regarding an operating system that is no longer supported by the operating system manufacturer:

WinCE5 is an obsolete operating system, which is no longer supported by the operating system manufacturer and only applies to PageWriter TC20, TC30, TC50 and TC70.
PageWriter TC50 and TC70 support WinCE7, which is available for download on InCenter by customers. Philips recommends replacing the TC20 and TC30 with the TC50 if customers are concerned about the obsolete operating system. For TC20, there will be an update to a supported operating system released by end of 2019.

Philips offers the following additional mitigation advice:

Defense in depth
Physical security is a foundational requirement
For medical devices such as a PageWriter, controlling access to the system components provides key protection to the medical devices in the system.
Physical security is a combination of policy, procedure and practice to control and monitor who has physical access.
For medical devices, physical security provides multifactor authentication (the user physically must be at the device and provide something they know).

External links

https://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01

2) Use of hardcoded credentials