CVE-2019-13530

Published: Sep 12, 2019Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). An attacker can use these credentials to login via ftp and upload a malicious firmware.

Affected (4)

Products: Philips: Intellivue Mp Monitors Mp20 Mp90 Firmware, Intellivue Mp Monitors Mp5/5sc Firmware, Intellivue Mp Monitors Mp2/x2 Firmware, Intellivue Mp Monitors Mx800/700/600 Firmware

Philips

4 products

Intellivue Mp Monitors Mp20 Mp90 Firmware

Intellivue Mp Monitors Mp5/5sc Firmware

Intellivue Mp Monitors Mp2/x2 Firmware

Intellivue Mp Monitors Mx800/700/600 Firmware

Configuration A

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Philips Intellivue Mp Monitors Mp20 Mp90 Firmware	Version a.03.09

Running on/with	Platform Versions
Philips M80010a	Version a
Philips M8001a	Version a
Philips M8002a	Version a
Philips M8003a	Version a
Philips M8004a	Version a
Philips M8005a	Version a
Philips M8007a	Version a
Philips M8008a	Version a

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Philips Intellivue Mp Monitors Mp5/5sc Firmware	Version a.03.09

Running on/with	Platform Versions
Philips M8105a	Version a
Philips M8105as	Version a

Configuration C

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Philips Intellivue Mp Monitors Mp2/x2 Firmware	Version a01.09

Running on/with	Platform Versions
Philips M3002a	Version b
Philips M8102a	Version b

Configuration D

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Philips Intellivue Mp Monitors Mx800/700/600 Firmware	Version a.01.09

Running on/with	Platform Versions
Philips 865240	Version b
Philips 865241	Version b
Philips 865242	Version b

Related CWEs

CWE-259

Use of Hard-coded Password

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

https://www.us-cert.gov/ics/advisories/icsma-19-255-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsma-19-255-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.