title: Philips Patient Monitoring Devices Improper Check for Certificate Revocation
description: In Patient Information Center iX (PICiX) Versions C.02 and C.03,
PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors
MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and
prior, the software does not check or incorrectly checks the revocation
status of a certificate, which may cause it to use a compromised
certificate.
problem types: CWE-299 Improper Check for Certificate Revocation
affected:
{
defaultStatus: unaffected
product: Patient Information Center iX (PICiX)
vendor: Philips
versions:
status: affected, version: C.02
status: affected, version: C.03
}
{
defaultStatus: unaffected
product: PerformanceBridge Focal Point
vendor: Philips
versions:
status: affected, version: A.01
}
{
defaultStatus: unaffected
product: IntelliVue patient monitors
vendor: Philips
versions:
status: affected, version: MX100
status: affected, version: MX400-MX550
status: affected, version: MX750
status: affected, version: MX850
}
{
defaultStatus: unaffected
product: IntelliVue X3
vendor: Philips
versions:
lessThanOrEqual: N , status: affected, version: 0, versionType: custom
}
solutions: Philips released the following versions to remediate reported vulnerabilities:
*  Patient Information Center iX (PICiX) Version C.03
*  PerformanceBridge Focal Point
*  IntelliVue Patient Monitors Versions N.00 and N.01
*  IntelliVue Patient Monitors Version M.04: Contact a  Philips service support team https://www.usa.philips.com/healthcare/solutions/customer-service-solutions  for an upgrade path
*  Certificate revocation within the system was implemented for PIC iX
and Performance Bridge FocalPoint in 2023. The implementation of the
IntelliVue Patient Monitors will be completed in Q3 of 2024.
workarounds: As a mitigation to these vulnerabilities, Philips recommends the following:
*  The Philips patient monitoring network is required to be physically
or logically isolated from the hospital local area network (LAN).
Philips recommends using a firewall or routers that can implement access
control lists restricting access in and out of the patient monitoring
network for only necessary ports and IP addresses. Refer to the Philips
Patient Monitoring System Security for Clinical Networks guide for
additional information on  InCenter https://incenter.medical.philips.com/ .
*  By default, the simple certificate enrollment protocol (SCEP)
service is not running. When needed, the service is configured to run
based on the duration or the number of certificates to be assigned. One
certificate is default, but if a certificate is not issued, the service
will continue to run. Limit exposure by ensuring the SCEP service is not
running unless it is actively being used to enroll new devices.
*  When enrolling new devices using SCEP, enter a unique challenge password of 8-12 unpredictable and randomized digits.
*  Implement physical security controls to prevent unauthorized login
attempts on the PIC iX application. Servers should be kept in controlled
locked data centers. Access to equipment at nurses’ stations should be
controlled and monitored.
*  Only grant remote access to PIC iX servers on a must-have basis.
*  Grant login privileges to the bedside monitor and PIC iX application
on a role-based, least-privilege basis, and only to trusted users.
Users with questions regarding their specific Philips Patient
Information Center (PIC iX) and/or IntelliVue patient monitor
installations and new release eligibility should contact their local  Philips service support team, or regional service support https://www.usa.philips.com/healthcare/solutions/customer-service-solutions , or call 1-800-722-9377.
Please see the  Philips product security website https://www.philips.com/productsecurity  for the Philips advisory and the latest security information for Philips products.