CVE-2018-8856

This CVE affects Philips e-Alert Unit (non-medical device), Versions R2.1 and prior. The issue is the use of a hard-coded cryptographic key for internal data encryption (CWE-798), which enables high-severity impact. Per the connected docs, CVSS v3 base score is 9.8 (critical) with remote/network ...

CVE-2018-8846

Philips e-Alert Unit (non-medical device), Version R2.1 and prior, contains an input handling flaw that allows cross-site scripting when user-controlled data is placed in web page output. This CVE (CVE-2018-8846) is documented with a CWE-79 XSS pattern and a CVSS v3 base score of 7.1 (AV:N/AC:L/P...

CVE-2018-8850

Philips e-Alert Unit (non‑medical) Version R2.1 and prior is affected by CVE-2018-8850 due to improper input validation (CWE-20), which can cause unintended input, altered control flow, or arbitrary code execution. The vulnerability is documented with high to critical impact (NVD CVSS v3 base 9.8...

CVE-2018-14803

Philips e-Alert Unit (non-medical device), Version R2.1 and prior, is affected by CVE-2018-14803 which describes an information-disclosure vulnerability: an attacker could obtain extraneous product information (e.g., OS/software components) via HTTP response headers that are normally not exposed....

CVE-2018-8842

CVE-2018-8842 affects Philips e-Alert Unit (non-medical) versions R2.1 and prior, where sensitive data is transmitted in cleartext over a network, enabling potential disclosure of personal contacts and login credentials within the same subnet. Root cause: cleartext transmission of sensitive infor...

CVE-2018-8844

Philips e-Alert Unit (non‑medical device), Version R2.1 and prior, contains a Cross‑Site Request Forgery (CSRF) weakness in which the web application does not sufficiently verify that a user’s request is intentional. This CSRF issue could allow an attacker to perform unauthorized operations when ...

CVE-2018-8854

CVE-2018-8854 affects Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The issue is Uncontrolled Resource Consumption (Resource Exhaustion): the software does not properly restrict the size/amount of resources requested, allowing an attacker to consume resources. Affects Philips...

ICSMA-18-240-01_Qualcomm Life Capsule

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Qualcomm Life Equipment: Capsule Datacaptor Terminal Server DTS Vulnerability: Code Weakness 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute...

Researcher Billy Rios, Talks Medical Device Security at RSA Conference 2018

Researcher Billy Rios, founder of WhiteScope, discusses medical device hacking at RSA Conference 2018 with Threatpost’s Tom Spring. Rios also talks about his work where he demonstrated how an attacker could remotely hack an internet-connected car wash and used it to attack and damage vehicles...

CVE-2017-12725

CVE-2017-12725 affects Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, versions 1.1, 1.5 and 1.6. The vulnerability stems from hard-coded credentials used to auto-establish a wireless connection with default network configuration, potentially enabling remote access. If the pump is E...

The Archimedes Medical Device Security 101 Conference - A Secure Forum for Security Issues

The University of Michigans Archimedes Center for Medical Device Security hosted its second annual MDS 101 conference in Orlando this month. The conference provides a secure forum for attendees to speak freely about cybersecurity issues with respected professionals who can help establish best...

Threat Predictions for Connected Life in 2018

Download the Kaspersky Security Bulletin: Threat Predictions for Connected Life in 2018 Introduction: To be awake is to be online The average home now has around three connected computers and four smart mobile devices. Hardly surprising, considering that 86 per cent of us check the Internet sever...

Philips IntelliSpace Cardiovascular System and Xcelera System Vulnerability

OVERVIEW Philips reported a vulnerability in the Philips’ IntelliSpace Cardiovascular and Xcelera cardiac image and information management systems. Philips has produced updates that mitigate this vulnerability in the affected products. This vulnerability could be exploited remotely. AFFECTED...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

465k Pacemakers vulnerable; users must visit doctors for fix

By Waqas Are you using Pacemaker device manufactured by Abbott Laboratories previously St. This is a post from HackRead.com Read the original post: 465k Pacemakers vulnerable; users must visit doctors for fix...

St. Jude Patches Additional Cardiac Device

St. Jude Medical has patched a vulnerability in another Merlin@home Transmitter medical device vulnerable to a man-in-the-middle attack. The medical device maker issued an update on Monday for its Merlin@home Transmitter “inductive” models, expanding the number of devices impacted by a...

Justine Bone on St. Jude Vulnerabilities and Medical Device Security

MedSec CEO Justine Bone talks to Mike Mimoso about the St. Jude Medical vulnerabilities, the considerations her company and Muddy Waters made in short selling St. Jude stock, and the current state of medical device security. Download: JustineBoneonSt.JudeVulnerabilitiesandMedicalDeviceSecurity.mp...

Marie Moe on Medical Device Security

Marie Moe, a research scientist at SINTEF of Norway, talks to Mike Mimoso about her personal and emotional connection to medical device security given that she has a pacemaker implanted in her that regulates her heart. Moe, who is in her 30s, has been active in spurring research into the security...

DMCA Exemptions Lift Hacking Restriction

White hat hackers can breathe a little easier for the next two years because of a temporary removal of restrictions imposed on hacking of everything from cars, medical devices, to smart home appliances. Last week the U.S. Copyright Office temporarily removed certain restrictions imposed by the...

Animas OneTouch Ping Authentication Bypass Vulnerability (CNVD-2016-08537)

The Animas OneTouch Ping is a medical self-service device for diabetics taking insulin from Animas USA. The Animas OneTouch Ping device uses a customized communication protocol that allows an unauthenticated remote attacker to bypass authentication by relaying the attack and spoofing the affected...