ICS Advisory (ICSA-14-121-01)

AMTELCO miSecure Vulnerabilities

Legal Notice

All information products included in https://us-cert.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://www.us-cert.gov/tlp/.



Researcher Jared Bird of Allina Health reported multiple vulnerabilities in the AMTELCO miSecureMessage (MSM) medical messaging system. AMTELCO has an update available to all customers that mitigates the vulnerabilities. The vulnerabilities were discovered during cooperative testing between Allina Health and AMTELCO. This issue was separately reported to CERT/CC, which posted a notification on April 11, 2014, available here:


These vulnerabilities can be exploited remotely. Exploits that target these vulnerabilities are known to be publicly available.


The following AMTELCO products are affected:

  • miSecureMessages, Version 6.2 (to include Android, iPhone, and Blackberry mobile device applications).


The MSMs Release 6.2 web service may be susceptible to intrusion, allowing an intruder to receive messages intended for MSM users.

Impact to individual organizations and users depends on many factors that are unique to each organization and user. NCCIC/ICS-CERT recommends that organizations and users evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.


AMTELCO is a US-based company that provides call center communication systems and software applications for call centers, contact centers, healthcare facilities, higher education facilities, executive suites, and developers. In addition to call center systems, AMTELCO offers web-based hosted services and other wireless applications.

The affected products, MSMs, is a HIPAA-compliant, cloud-based messaging and notification application for doctors and hospitals to communicate securely with patients over cellphone and Wi-Fi. AMTELCO products are used in the United States and in more than 20 foreign countries.




MSM does not have sufficient session management to prevent modification of message requests. This could allow a valid user to retrieve sensitive message contents and exposing personally identifiable information of other users.

CVE-2014-2347b has been assigned to this vulnerability. A CVSS v2 base score of 7 has been assigned; the CVSS vector string is (AV:N/AC:M/Au:S/C:C/I:P/A:N).c


MSM does not contain sufficient authentication complexity that may allow an attacker to receive message traffic between healthcare providers and patients, potentially exposing personally identifiable information.

CVE-2014-0357e has been assigned to this vulnerability. A CVSS v2 base score of 7 has been assigned; the CVSS vector string is (AV:N/AC:M/Au:S/C:C/I:P/A:N).f



These vulnerabilities could be exploited remotely.


Exploits that target these vulnerabilities are publicly available.


Crafting a working exploit for these vulnerabilities would need a moderate skill level. An amount of session modification is required to exploit these vulnerabilities. This decreases the likelihood of a successful exploit.


AMTELCO has developed an update, Version 6.3, that resolves these vulnerabilities.

Schedule an upgrade by emailing or calling AMTELCO’s Field Engineering Department at:
email: service@amtelco.com
phone: 1-800-553-7679

Link to the Security Advisory (registration required):


Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents. Individuals should report any malicious activity to their healthcare provider.

In addition, ICS-CERT recommends that users take the following measures to protect themselves from social engineering attacks:

  1. Do not click web links or open unsolicited attachments in email messages.
  2. Refer to Recognizing and Avoiding Email Scamsg for more information on avoiding email scams.
  3. Refer to Avoiding Social Engineering and Phishing Attacksh for more information on social engineering attacks.
  • a. CWE-200: Information Exposure, http://cwe.mitre.org/data/definitions/200.html, web site last accessed May 01, 2014.
  • b. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2347, NIST uses this advisory to create the CVE web site report. This web site will be active sometime after publication of this advisory.
  • c. CVSS Calculator, http://nvd.nist.gov/cvss.cfm?version=2&vector=AV:N/AC:M/Au:S/C:C/I:P/A:N, web site last accessed May 01, 2014.
  • d. CWE-287: Improper Authentication, http://cwe.mitre.org/data/definitions/287.html, web site last accessed May 01, 2014.
  • e. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0357, web site last accessed May 01, 2014.
  • f. CVSS Calculator, http://nvd.nist.gov/cvss.cfm?version=2&vector=AV:N/AC:M/Au:S/C:C/I:P/A:N, web site last accessed May 01, 2014.
  • g. Recognizing and Avoiding Email Scams, http://www.us-cert.gov/reading_room/emailscams_0905.pdf, web site last accessed May 01, 2014.
  • h. National Cyber Alert System Cyber Security Tip ST04-014, http://www.us-cert.gov/cas/tips/ST04-014.html, web site last accessed May 01, 2014.

Contact Information

For any questions related to this report, please contact the CISA at:

Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870

For industrial control systems cybersecurity information:  https://www.us-cert.gov/ics 
or incident reporting:  https://www.us-cert.gov/report

CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No