CVE-2017-9657

Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX40 is not connected or associated to the central monitor, and thus should be operating in local monitoring mode (local audio-on, screen-on), but the MX40 WLAN itself can instead still be operating in telemetry mode (local audio-off, screen-off). If a patient experiences an alarm event and clinical staff expects the MX40 to provide local alarming when it is not available from the local device, a delay of treatment can occur. CVSS v3 base score: 6.5, CVSS vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Philips has released software update, Version B.06.18, to fix the improper cleanup on thrown exception vulnerability, and implement mitigations to reduce the risk associated with the improper handling of exceptional conditions vulnerability. The software update implements messaging and alarming on the MX40 and at the central monitoring station, when the MX40 disconnects from the access point.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:philips:intellivue_mx40_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:philips:intellivue_mx40:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:36

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/100813 - VDB Entry, Third Party Advisory () http://www.securityfocus.com/bid/100813 - Third Party Advisory, VDB Entry
References () https://ics-cert.us-cert.gov/advisories/ICSMA-17-255-01 - Third Party Advisory, US Government Resource () https://ics-cert.us-cert.gov/advisories/ICSMA-17-255-01 - Third Party Advisory, US Government Resource
References () https://www.usa.philips.com/healthcare/about/customer-support/product-security - Vendor Advisory () https://www.usa.philips.com/healthcare/about/customer-support/product-security - Vendor Advisory

Information

Published : 2018-04-30 15:29

Updated : 2024-11-21 03:36


NVD link : CVE-2017-9657

Mitre link : CVE-2017-9657

CVE.ORG link : CVE-2017-9657


JSON object : View

Products Affected

philips

  • intellivue_mx40
  • intellivue_mx40_firmware
CWE
CWE-460

Improper Cleanup on Thrown Exception

CWE-755

Improper Handling of Exceptional Conditions