Hard-coded credentials in Philips IntelliVue WLAN, portable patient monitors
Priority LOW 34CWE-259Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-259.
Summary
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). An attacker can use these credentials to login via ftp and upload a malicious firmware.
Why it matters now
EPSS 0.01358 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Philips IntelliVue WLAN, portable patient monitors | WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) | — | No fix listed | CNA |
- Philips IntelliVue WLAN, portable patient monitors Vendor— Affected WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:philips:intellivue_mp_monitors_mp20-mp90_firmware:a.03.09:*:*:*:*:*:*:* | a.03.09 | Vulnerable | Philips |
| cpe:2.3:h:philips:m80010a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8001a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8002a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8003a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8004a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8005a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8007a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8008a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:o:philips:intellivue_mp_monitors_mp5\/5sc_firmware:a.03.09:*:*:*:*:*:*:* | a.03.09 | Vulnerable | Philips |
- cpe:2.3:o:philips:intellivue_mp_monitors_mp20-mp90_firmware:a.03.09:*:*:*:*:*:*:* Versions a.03.09 Vulnerable ·Philips
- cpe:2.3:h:philips:m80010a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8001a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8002a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8003a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8004a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8005a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8007a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8008a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:o:philips:intellivue_mp_monitors_mp5\/5sc_firmware:a.03.09:*:*:*:*:*:*:* Versions a.03.09 Vulnerable ·Philips
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:philips:m8105a:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:h:philips:m8105as:a:*:*:*:*:*:*:* | a | Running on | Philips |
| cpe:2.3:o:philips:intellivue_mp_monitors_mp2\/x2_firmware:a01.09:*:*:*:*:*:*:* | a01.09 | Vulnerable | Philips |
| cpe:2.3:h:philips:m3002a:b:*:*:*:*:*:*:* | b | Running on | Philips |
| cpe:2.3:h:philips:m8102a:b:*:*:*:*:*:*:* | b | Running on | Philips |
| cpe:2.3:o:philips:intellivue_mp_monitors_mx800\/700\/600_firmware:a.01.09:*:*:*:*:*:*:* | a.01.09 | Vulnerable | Philips |
| cpe:2.3:h:philips:865240:b:*:*:*:*:*:*:* | b | Running on | Philips |
| cpe:2.3:h:philips:865241:b:*:*:*:*:*:*:* | b | Running on | Philips |
| cpe:2.3:h:philips:865242:b:*:*:*:*:*:*:* | b | Running on | Philips |
- cpe:2.3:h:philips:m8105a:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:h:philips:m8105as:a:*:*:*:*:*:*:* Versions a Running on ·Philips
- cpe:2.3:o:philips:intellivue_mp_monitors_mp2\/x2_firmware:a01.09:*:*:*:*:*:*:* Versions a01.09 Vulnerable ·Philips
- cpe:2.3:h:philips:m3002a:b:*:*:*:*:*:*:* Versions b Running on ·Philips
- cpe:2.3:h:philips:m8102a:b:*:*:*:*:*:*:* Versions b Running on ·Philips
- cpe:2.3:o:philips:intellivue_mp_monitors_mx800\/700\/600_firmware:a.01.09:*:*:*:*:*:*:* Versions a.01.09 Vulnerable ·Philips
- cpe:2.3:h:philips:865240:b:*:*:*:*:*:*:* Versions b Running on ·Philips
- cpe:2.3:h:philips:865241:b:*:*:*:*:*:*:* Versions b Running on ·Philips
- cpe:2.3:h:philips:865242:b:*:*:*:*:*:*:* Versions b Running on ·Philips
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13530
- 2026-10-03 Alias added: GHSA-q33g-568m-5mjj
References
More Philips Intellivue Mp Monitors Mp20-mp90 Firmware vulnerabilities
- TI-2019-10166 Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09… CVSS 3.1HIGH 7.2
Sources
- CVE-2019-13530 · CVE Program
- CVE-2019-13530 · NVD
- FIRST EPSS
- GHSA-q33g-568m-5mjj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences