Carestream Health in MedDevice Cyber coverage: 8 stories, 12 products named, 20 CVEs, and the company's own disclosures.
Carestream advisory CARESTREAM-2022-01 says DirectView, ImageView, DryView, Image Suite and MyVue Center Kiosk systems with Axeda clients before 6.9.2 connected to Smart Link RMS are exposed to Access:7, CVE-2022-25246 to CVE-2022-25252; it reports remotely patching more than 99 percent of impacted devices.
Carestream advisory CARESTREAM-2021-05 lists CR825 to CR975, DirectView Max CR, Image Suite V4, CRescendo, DRX-Excel and OMNI as impacted by Print Spooler flaws including CVE-2021-34527; ImageView DRX systems are not impacted.
Carestream advisory CARESTREAM-2021-01 lists ImageView V1.8-1.X and V1.3-1.7 DRX systems as affected by CVE-2021-21148, a heap buffer overflow in Chrome's V8 engine. Compensating controls mitigate it until Chrome is updated in the next software release.
Carestream advisory CARESTREAM-2020-01 lists products on Windows 10, Server 2016 and Server 2019, including ImageView DRX systems and OnSight 3D, as affected by CVE-2020-0601, the CryptoAPI certificate spoofing flaw.
Carestream advisory CARESTREAM-2019-04 lists DirectView CR and DR systems and ImageView based systems as affected by the BlueKeep (CVE-2019-0708) and DejaBlue Remote Desktop Services flaws. Carestream completed patch qualification.
CISA advisory ICSMA-18-277-01 covers CVE-2018-17891 (CVSS 3.7) in Carestream Vue RIS client builds 11.2 and prior on Windows 8.1 with IIS 7.5: an HTTP 500 error leaks technical information. The current version fixes it and Carestream supplies workarounds for older builds.
Carestream advisory CARESTREAM-XRS-2018-01 lists DirectView V5.7 CR systems and DRX systems on Windows Embedded Standard 7 as impacted by Meltdown and Spectre (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754) while the Microsoft patch is evaluated.
Carestream advisory CARESTREAM-XRS-2017-01 lists DRX systems using DRX-1 and DRX-Plus wireless detectors as affected by the KRACK WPA2 flaws (CVE-2017-13077 to CVE-2017-13088). Carestream rates the risk low and is preparing detector patches and access point firmware.
Carestream Health products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.
| Product | Device type | Attributes | Matched advisories |
|---|---|---|---|
| Image Suite | System, Image Processing, Radiological | 24 | 42 |
| DRX - Compass | System, X-Ray, Stationary | 23 | 9 |
| Lux 35 Detector | Solid State X-Ray Imager (Flat Panel/Digital Imager) | 11 | 1 |
| DRX-Evolution Plus System | System, X-Ray, Stationary | 27 | 0 |
| DRX-Evolution Plus X-ray System | System, X-Ray, Stationary | 7 | 0 |
| DRX-Revolution Mobile X-ray System | System, X-Ray, Mobile | 19 | 0 |
| DRX-Rise Mobile X-ray System | System, X-Ray, Mobile | 27 | 0 |
| Eclipse II with Smart Noise Cancellation | Solid State X-Ray Imager (Flat Panel/Digital Imager) | 6 | 0 |
| Lux HD Detectors, DRX-LC Detector, DRX-Revolution Mobile X-Ray System | System, X-Ray, Mobile | 9 | 0 |
| Q-Rad System | System, X-Ray, Stationary | 9 | 0 |
| Vita Flex CR System with LLI | Solid State X-Ray Imager (Flat Panel/Digital Imager) | 18 | 0 |