Philips in MedDevice Cyber coverage: 144 stories, 175 products named, 203 CVEs, and the company's own disclosures.
Philips listed PIC iX 4.x in an October 26 advisory for CVE-2026-111497, the Node2Shell flaw in the Node.js Brotli decoder. Node.js rates it High and says it can lead to remote code execution on the 22.x, 24.x, and 26.x lines. Philips names no fixed version and says customers are responsible for applying the applicable mitigations.
Philips published an advisory on October 21, and updated it October 26, for CVE-2026-109618 and CVE-2026-109619, the PHP2Shell flaws, each rated 9.2 on CVSS v4.0 by the PHP security team. Seven Philips products are listed. The advisory names no fixed version number and recommends removing PHP from systems that run NeuroQuant.
Philips said on October 19 that no Philips products are known to be impacted by CVE-2026-102764, an exploited BeyondTrust Remote Support authentication bypass that CISA added to its Known Exploited Vulnerabilities catalog on October 16. An October 15 notice says the same for CVE-2026-104935, an exploited Ivanti Connect Secure flaw.
Philips said on October 8, 2026 that 839001 Vue PACS 12.2 is affected by the critical NextGen Healthcare Mirth Connect flaws CVE-2026-78224, CVE-2026-82578 and CVE-2026-82583 (ICSMA-26-253-01). Its hosting business is deploying patches to the managed infrastructure.
Philips said September 29 that none of its products are affected by CVE-2026-19490, a CVSS 9.3 NetScaler ADC and Gateway authentication bypass that CISA added to its Known Exploited Vulnerabilities catalog on September 9. The same advisory covers CVE-2026-19489, an 8.8 memory overflow in the same appliances.
Philips said on September 29, 2026 that no Philips products are known to be impacted by the critical Citrix NetScaler ADC and NetScaler Gateway vulnerabilities CVE-2026-88771 through CVE-2026-88778, and told Remote Services Network users not to disconnect the PRS.
Philips said on September 11, 2026 that no Philips products are known to be impacted by CVE-2026-82329, a critical JFrog Artifactory authentication weakness that under default configuration may give an unauthenticated attacker administrative privileges.
Philips published a September 4 advisory for CVE-2026-75604, a Next.js path traversal scored 9.0 that lets remote requests read private build data on Windows hosts and reach remote code execution. Versions 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2 are affected, and Vercel fixed it in 15.5.24 and 16.3.3. Philips says no Philips products are known to be impacted at this time.
CVE-2026-8452, a CVSS 8.8 heap overflow in NetScaler ADC and Gateway SAML handling, went from a watchTowr proof of concept on August 14 to active exploitation by August 17. Philips cleared its own products in an August 18 advisory. For device makers, the exposed appliance guards the same networks their products and remote service sessions run on.
Cl0p attached names to nearly 50 leak site entries on August 12, with Philips, Shell, Fiserv and GE among them. The campaign exploits CVE-2026-12569, a CVSS 9.8 deserialization flaw in PTC Windchill and FlexPLM patched June 17 and exploited from June 18. Philips says it contained an attempted compromise of one enterprise server.
A security vendor’s breach. A DICOM toolkit. A Windows kernel RCE. A Defender bypass. Four advisories in two months, none for a bug Philips wrote.
Philips named Advanced Visualization Workspace V15 and V16, Incisive CT, CT 3500, Access CT and MX16 as affected by OFFIS DCMTK vulnerabilities in a July 8, 2026 notice. The company is monitoring the CISA advisory on the DICOM toolkit.
Philips named PIC iX 4.x as affected by Microsoft Windows DHCP vulnerabilities CVE-2026-44815 and CVE-2026-45602 on June 22, 2026. Microsoft has released patches for both.
On June 4, 2026 Philips listed Advanced Visualization Workspace V15, IntelliSpace Perinatal, PIC iX 4.x, IntelliVue Guardian Software, IntelliVue XDS and UroNav as affected by three critical, actively exploited Windows Defender flaws, CVE-2026-33825, CVE-2026-41091 and CVE-2026-45498.
Philips listed Advanced Visualization Workspace V15 as affected by CVE-2026-42945, a critical F5 NGINX vulnerability affecting NGINX Plus and NGINX Open Source, on May 21, 2026.
Philips named FocalPoint versions before v2.2 (867113) as affected by CVE-2026-31431, the Linux Copy Fail flaw that lets an unprivileged local user gain root, in a May 4, 2026 notice.
Philips named Capsule Neuron and IntelliSpace Critical Care and Anesthesia (ICCA) in a March 31, 2026 notice on Microsoft Secure Boot certificates. The company says it is monitoring developments.
Philips named Advanced Visualization Workspace 15, IntelliVue Guardian Software, IntelliVue XDS and IntelliSpace Perinatal on November 19, 2025 under CVE-2025-62215, a Windows kernel zero day Microsoft confirmed as exploited in the wild.
On November 5, 2025 Philips named Focal Point 2.x and IntelliSpace Cardiovascular 8.1 under CVE-2025-55315, an ASP.NET Core security feature bypass reachable with crafted HTTP requests.
Philips named Advanced Visualization Workspace 15, PIC iX (C.x, 4.x) and Focal Point on October 27, 2025 under CVE-2025-59287, a critical, actively exploited remote code execution flaw in Windows Server Update Service.
After CISA Emergency Directive 26-01 on F5 BIG-IP, Philips listed IntelliSpace PACS, Philips PRS and Vue PACS in an October 17, 2025 notice.
Philips named Device Management Dashboard A.02.01, IntelliSpace ECG Management System B.02.07 and Trace Master Vue 3.6 on July 22, 2025 under CVE-2025-6558 in Chrome's ANGLE component.
On July 15, 2025 Philips named Device Management Dashboard A.02.01, IntelliSpace ECG Management System B.02.07 and Trace Master Vue 3.6 under CVE-2025-6554, a type confusion flaw in Chrome's V8 engine.
Philips named Capsule Surveillance on June 6, 2025 under CVE-2025-5419, an out-of-bounds read and write in Chrome's V8 engine.
On May 20, 2025 Philips named the ST80i and PIC iX under CVE-2025-32706 and CVE-2025-30397, Windows flaws that allow privilege elevation and code execution over a network.
Philips named Advanced Visualization Workspace 15, IntelliSpace Perinatal, IntelliVue Guardian, Corsium, IntelliVue XDS, ST80i, ECI Event and Device Readiness and IntelliSpace Portal 11/12 on April 16, 2025 under CVE-2025-29824, a Windows CLFS zero day.
Philips flagged deserialization of untrusted data in IntelliSpace Portal and Advanced Visualization Workspace: .NET Remoting on TCP 755 with TypeFilterLevel set to Full, a path to remote code execution.
On April 3, 2025 Philips named Device Management Dashboard A.02.01, IntelliSpace ECG Management System B.02.07, PIC iX and Trace Master Vue 3.6 under CVE-2025-2783, a critical Chromium zero day that bypasses the sandbox.
Philips named Focal Point v2.1 on March 27, 2025 under IngressNightmare, four critical flaws (CVE-2025-1974, CVE-2025-24514, CVE-2025-1098, CVE-2025-1097) in the Ingress NGINX Controller for Kubernetes.
ICSMA-25-072-01: Philips IntelliSpace Cardiovascular built its auth tokens on a fixed AES-128 key identical across all installations, and let the login token be replayed to bypass authentication.
Philips warned that malware is circulating impersonating its legitimate DICOM Viewer software. Not a product flaw, a brand-impersonation threat that turns your download page into an attacker channel.
Philips named Focal Point, Vue PACS 12.2, IntelliBridge Enterprise, IntelliVue Guardian, VitalSky 2.4.0 and two China market products on February 21, 2025 under jQuery CVE-2020-11023 after CISA added it to the KEV catalogue; the listed versions are end of life.
Philips named PIC iX on January 28, 2025 under CVE-2024-11477 and CVE-2025-0411, two critical 7-Zip flaws that could let remote attackers execute code.
Philips listed IntelliVue XDS, IntelliVue Perinatal, Holter Tower, IntelliSpace PACS and six other product lines in a November 18, 2024 notice on CVE-2024-49039, a critical Windows Task Scheduler privilege escalation.
On September 20, 2024 Philips listed IntelliSpace PACS against VMware advisory VMSA-2024-0019, which covers CVE-2024-38812 and CVE-2024-38813 in vCenter Server and Cloud Foundation.
Philips named Corsium, ECI Event and Device Readiness and IntelliSpace PACS in a September 20, 2024 notice on CVE-2024-38202 and CVE-2024-21302, two critical Windows flaws that let attackers roll a patched system back to vulnerable versions.
Philips named more than 20 product lines, from Azurion and Allura interventional systems to EPIQ and Affiniti ultrasound, in an August 30, 2024 notice on CVE-2024-38063, a critical Windows TCP/IP remote code execution flaw reachable over IPv6.
Philips named the PIC iX patient information center in a July 19, 2024 notice on the worldwide Windows outage caused by a faulty CrowdStrike update.
CISA advisory ICSMA-24-200-01 reports default credentials (CVE-2023-40704, CVSS v3 6.8) and resource exhaustion (CVE-2021-28165, 6.5) in Philips Vue PACS before 12.2.8.410. Version 12.2.8.410, released October 2023, prevents the resource exhaustion; Philips will update database passwords on request.
Philips listed IntelliSpace PACS on May 23, 2024 against CVE-2024-22439, an HPE FlexFabric and FlexNetwork switch flaw that can give privileged access to the switch and disclose information.
On April 16, 2024 Philips listed VitalHealth Questionnaire Manager 6.3.3.0 after a CISA alert on a compromise at Sisense, the data analytics provider, and said it was evaluating mitigations.
Philips named Zenition 70, MsMs, Home+, VitalSky and Smarthopping in an April 8, 2024 notice on CVE-2023-48795, the Terrapin attack that downgrades SSH connection security during the handshake.
Philips named Care Event, PIC iX, Data Warehouse Connect, Focal Point and the Acute Patient Monitoring Platform in an April 5, 2024 notice on CVE-2024-2883, a critical Chromium ANGLE zero day that also affects Edge.
On February 29, 2024 Philips named IIT REACTS, Collaboration Live, Cardiologs and EarlyVue VS30 under CVE-2024-26582, a use-after-free in the Linux kernel TLS subsystem.
Philips named IntelliSpace PACS and Universal Data Manager 2 on November 23, 2023, as related to CVE-2023-46747, an unauthenticated remote code execution flaw in the F5 BIG-IP Configuration utility.
On November 3, 2023, Philips named Vue PACS and Vue RIS/EIS as related to CVE-2023-37679 and CVE-2023-43208, an easily exploitable unauthenticated remote code execution issue in the Mirth Connect integration platform.
Philips named products including HeartStart Event Review, IntelliVue XDS and IntelliSpace Perinatal on October 10, 2023, when Microsoft ended security updates for Windows Server 2012 and 2012 R2.
On July 12, 2023, Philips named all versions of Encore Anywhere and Care Orchestrator as related to MOVEit vulnerabilities CVE-2023-36932, CVE-2023-36933 and CVE-2023-36934.
Philips named Encore Anywhere and Care Orchestrator on June 7, 2023, in connection with the widely exploited MOVEit Transfer zero-day CVE-2023-34362 and the related CVE-2023-35036.
On May 3, 2023, Philips named CareEvent, IntelliSpace Perinatal, IntelliVue XDS, Data Warehouse Connect, IntelliVue Guardian Software and PICiX as related to CVE-2013-3900, a WinVerifyTrust Authenticode signature validation flaw Microsoft republished guidance on.
Philips named eleven product entries on April 17, 2023, including VitalSky, PICiX, Efficia Central CMS200 and IntelliSpace PACS, as related to CVE-2023-28252, a Windows CLFS zero-day exploited to deploy ransomware.
Philips named Capsule Neuron on March 29, 2023, as related to CVE-2023-21701, a Protected Extensible Authentication Protocol vulnerability that could let a remote attacker cause a denial of service.
On March 24, 2023, Philips named VitalSky, PICiX, CareEvent, Data Warehouse Connect, eMaaS and IntelliSpace Portal as related to CVE-2023-1017 and CVE-2023-1018 in the Windows TPM 2.0 Module Library.
Philips named CareEvent, IntelliSpace PACS, UroNav 3.0 and 4.1, Capsule Neuron, PICiX, Data Warehouse Connect and Universal Data Manager on March 22, 2023, as related to critical Windows RPC runtime flaws CVE-2023-21708 and CVE-2023-23405.
Philips named IntelliSpace ECG, IntelliSpace PACS, Trace Master Vue 3.6 and Universal Data Manager 2 in a February 6, 2023 notice on CVE-2021-21974, the VMware ESXi OpenSLP heap overflow behind a European ransomware wave.
Philips named IntelliSpace PACS on November 18, 2022, as related to two critical F5 BIG-IP and BIG-IQ vulnerabilities, CVE-2022-41622 and CVE-2022-41800, while F5 was still working on a fix.
Philips said on November 3, 2022, that it was monitoring 19 newly listed F5 vulnerabilities across BIG-IP, F5OS and NGINX, naming IntelliSpace PACS as the related product.
On October 20, 2022, Philips named Focal Point, Holter SW and ST80i as related to CVE-2022-37969, a Windows Common Log File System Driver zero-day that can grant SYSTEM privileges.
Philips named Capsule Neuron, IntelliSpace Portal Server 10 to 12 and IntelliSpace Enterprise Concerto on August 17, 2022, as related to CVE-2021-26414, a Windows DCOM security feature bypass Microsoft is fixing in phases through Q1 2023.
On August 9, 2022, Philips named IntelliSpace PACS and Universal Data Manager 1 as related to an F5 alert covering several critical BIG-IP vulnerabilities, for which F5 had released mitigations.
Philips named Flex Cardio, XperIM and SensaVue on June 30, 2022, as related to CVE-2022-30190 (Follina), a critical remote code execution flaw in the Windows Support Diagnostic Tool.
On May 13, 2022, Philips named IntelliSpace PACS and Universal Data Manager 1 as related to CVE-2022-1388, a critical vulnerability in F5 BIG-IP iControl REST, with F5 mitigations available.
Philips named Holter Recorder DigiTrak XT v3.0.4, IntelliSpace ECG TMV C.03.06 and ST80i A.03.01.00 on April 27, 2022, as related to CVE-2022-26784, a Windows Cluster Shared Volumes denial of service fixed in Microsoft's April update.
On April 26, 2022, Philips named twelve product entries, including IntelliSpace PACS, VUE PACS, VUE RIS and IntelliSpace Portal Server, as related to CVE-2022-26809, a critical unauthenticated remote code execution flaw in the Windows RPC runtime.
Philips named IntelliBridge Enterprise B.6 to B.16, IntelliSpace Perinatal, IntelliVue Guardian Software, IntelliSpace Concerto, IntelliSpace Portal and IntelliVue XDS on April 15, 2022, as related to CVE-2022-24491, a critical Windows NFS remote code execution flaw.
Philips named CardioVascular Scheduler 4.0 on April 5, 2022, as related to CVE-2022-22965 (Spring4Shell), a critical remote code execution flaw in the Spring Core Java framework.
Philips disclosed on March 29, 2022, one potential vulnerability in the e-Alert hardware solution, versions 2.7 and prior, that may let an attacker on the same subnet impact system availability.
CISA advisory ICSMA-22-088-01 covers CVE-2022-0922 (CVSS 6.5), missing authentication for a critical function in Philips e-Alert 2.7 and prior that lets an unauthorized actor on the facility network shut the system down. Philips planned a fix before July 2022.
On March 28, 2022, Philips named IntelliVue XDS and VuePACS 12.1.5 and 12.2.x as related to five Apache Log4j 1.x vulnerabilities, including CVE-2021-4104 and CVE-2019-17571, in a library Apache no longer supports.
Philips named ten product entries on March 23, 2022, including IntelliVue Guardian Software E.0x, IntelliBridge Enterprise B.09 to B.15 and PICiX C.0x, as related to CVE-2022-21849, a critical Windows IKE Extension remote code execution flaw patched in January.
On March 8, 2022, Philips listed Capsule Support Access Tool and Respilink in connection with Access:7, vulnerabilities affecting all versions of PTC's Axeda Agent and Axeda Desktop Server for Windows.
Philips named the IntelliSite Pathology Solution Ultra Fast Scanner on January 28, 2022, as related to CVE-2021-4034 (PwnKit), a local privilege escalation in polkit's pkexec on Linux.
Philips disclosed a vulnerability in Philips Engage Software version 6.2.1 and prior on January 6, 2022, after deploying the fixed version 6.2.2 to all customers on September 28, 2021.
CISA advisory ICSMA-22-006-01 reports improper access control (CVE-2021-23173, CVSS v3 2.6) in Philips Engage Software 6.2.1 and prior. Philips deployed Version 6.2.2 to its hosted service in September 2021; users need take no action.
Philips lists Vue PACS components, IntelliBridge Enterprise B.13 to B.15, Universal Data Manager, Tasy EMR and IntelliSpace Portal among products affected by CVE-2021-44228, the critical Log4j remote code execution flaw.
Philips lists Pinnacle 18.x as affected by CVE-2021-40438, an actively exploited server-side request forgery flaw in Apache HTTP Server 2.4.48 and earlier.
Philips disclosed hard-coded credentials and authentication bypass using an alternate path or channel in IntelliBridge EC40 and EC80 systems, versions C.00.04 and prior.
CISA advisory ICSMA-21-322-01 covers hard-coded credentials (CVE-2021-32993) and an authentication bypass through an alternate channel (CVE-2021-33017), both CVSS 8.1, in Philips IntelliBridge EC 40 and EC 80 hubs C.00.04 and prior. Philips planned a fix by the end of Q4 2021.
CISA advisory ICSMA-21-322-02 covers three flaws in Philips Patient Information Center iX and Efficia CM Series monitors, including a hard-coded cryptographic key (CVE-2021-43552) and a broken algorithm (CVE-2021-43550). PIC iX C.03.06 fixes the input validation flaw; the crypto fixes were planned for Q2 2023.
Philips disclosed improper access control, incorrect ownership assignment and potential exposure of sensitive information in Philips MRI 1.5T and MRI 3T software versions 5.3 through 5.8.1.
CISA advisory ICSMA-21-313-01 covers three flaws (CVE-2021-26262, CVE-2021-26248, CVE-2021-42744, each CVSS 6.2) in Philips MRI 1.5T and 3T software 5.3 to before 5.8.1 that let an operator-level user view system files and export patient data. Version 5.8.2 fixes them.
CISA advisory ICSMA-21-308-01 covers two SQL injection flaws (CVE-2021-39375, CVE-2021-39376, CVSS 8.8) in Philips Tasy EMR HTML5 3.06.1803 and prior. Philips recommends Version 3.06.1804 or later with the latest service pack.
Philips lists IntelliSpace PACS in its September 30, 2021 advisory on VMware VMSA-2021-0020.1, which covers multiple vulnerabilities in vCenter Server and Cloud Foundation.
Philips lists CarePoint as affected by Apple vulnerabilities CVE-2021-30858 and CVE-2021-30860, addressed in Apple's security update.
Philips lists 11 products, including IntelliSpace PACS, UDM/ISR, IntelliSpace Perinatal and IntelliVue XDS, as affected by CVE-2021-36942, the PetitPotam Windows flaw that can compromise domain controllers.
Philips lists 14 products, including IntelliSpace Portal Workstation 11.0 and 12.0, IntelliSpace Perinatal K.0 and IntelliVue XDS, as affected by CVE-2021-36934, the HiveNightmare Windows elevation of privilege flaw.
Philips lists 15 products, including PIC iX B.0x and C.0x, IntelliSpace Critical Care and Anesthesia, IntelliVue Guardian E.0x and eICU eCare Manager, as affected by CVE-2021-34481, a Windows Print Spooler elevation of privilege flaw.
CISA advisory ICSMA-21-187-01 (Update B) covers more than a dozen flaws in Philips Vue PACS, MyVue, Speech and Vue Motion 12.2.x.x, several in third-party components such as Redis and 7-Zip, with CVSS scores up to 9.8. Fixes shipped in 12.2.1.5 and 12.2.8.0.
Philips lists 54 product entries, including PIC iX, Pinnacle 18.x, IntelliSpace Critical Care and Anesthesia, Xper IM and Volcano Core imaging systems, under PrintNightmare, CVE-2021-34527, with CVE-2021-1675 also referenced.
CISA advisory ICSMA-21-175-01 covers CVE-2021-32966 (CWE-319, CVSS 3.7) in Philips Interoperability Solution XDS 2.5 to 3.11 and 2018-1 to 2021-1, where LDAP referrals over TLS can leak LDAP system credentials in cleartext.
Philips lists 15 products, including IntelliSpace PACS, PIC iX, Pinnacle 18.x and eCareManager, in its review of VMware vCenter Server flaws CVE-2021-21985 and CVE-2021-21986 from VMSA-2021-0010.
Philips lists IntelliSpace Perinatal J.x and consumer products including the Polaris Robot Vacuum Cleaner in its April 15, 2021 NAME:WRECK advisory, nine DNS flaws across FreeBSD, IPNet, NetX and Nucleus NET stacks.
CISA advisory ICSMA-21-084-01 covers CVE-2021-27456 (CVSS v3 2.4) in 11 Philips Gemini PET/CT family models, which store sensitive information, including patient information, on removable media with no built-in access control. Philips published guidance and mitigations.
On March 10, 2021, Philips listed Clinical Collaboration Platform, IntelliSpace PACS, Universal Data Manager and VueBeyond as products under review for F5's CVE-2021-22986, CVE-2021-22987, CVE-2021-22991 and CVE-2021-22992.
CISA advisory ICSMA-21-019-01 covers CVE-2020-27298 (CWE-78, CVSS v3 6.5) in Philips Interventional Workspot, ViewForum 6.3V1L10 and Coronary Tools 1.0. Anyone on the hospital network could shut down or restart the workstation; Philips is installing a patch under FCO 2019-IGTBST-014.
CISA advisory ICSMA-20-261-01 lists five vulnerabilities (CVE-2020-14506, CVE-2020-14525, CVE-2020-16198, CVE-2020-16200, CVE-2020-16247; CVSS v3 up to 6.8) in Philips Clinical Collaboration Platform 12.2.1 and earlier. Version 12.2.5 fixes four; one needs manual intervention.
In September 2020 Philips listed Vue PACS, IntelliSpace PACS 4.4 and 5.5x, IntelliSpace Portal Server 9.0 and 10.0, Illumeo 2.0, IntelliSpace ECG B.00 and others in its advisory on Zerologon, CVE-2020-1472.
CISA advisory ICSMA-20-254-01 (Update C) covers eight flaws in Philips IntelliVue monitors, Patient Information Center iX and PerformanceBridge Focal Point, including missing certificate revocation checks (CVE-2020-16228) and input that restarts monitors (CVE-2020-16216). Fixes include PIC iX C.03 and IntelliVue N.00 and N.01.
CISA advisory ICSMA-20-233-01 covers CVE-2020-16237 (CWE-20, CVSS 2.1) in Philips SureSigns VS4 A.07.107 and prior, which could expose administrative controls. Philips recommends unique passwords per device and replacing the VS4 with newer technology.
Philips disclosed a potential medium-severity vulnerability in DreamMapper software regarding access to log file information, affecting versions 2.24.x and prior.
CISA advisory ICSMA-20-212-01 reports that Philips DreamMapper version 2.24 and earlier insert sensitive information into log files (CVE-2020-14518, CVSS v3 5.3). Philips planned a remediating release by June 30, 2021.
Philips lists Clinical Collaboration Platform, IntelliSpace PACS 4.4, PIC iX Physiological Server, IntelliBridge Enterprise and UDM as affected by CVE-2020-1350, the SIGRED remote code execution flaw in Windows DNS Server.
Philips lists Clinical Collaboration Platform, IntelliSpace PACS 3.6 to 4.4.553, Universal Data Manager 1.1 to 3.1 and VueBeyond in its advisory on CVE-2020-5902, the F5 BIG-IP configuration utility remote code execution flaw.
CISA advisory ICSMA-20-177-01 covers CVE-2020-14477 (CVSS v3 3.6) in Philips Ultrasound ClearVue, CX, EPIQ/Affiniti, Sparq and Xperius, where an alternate service login path needs no authentication. Philips released EPIQ/Affiniti VM6.0 in April 2020 with other releases planned.
Philips issued a June 24, 2020 coordinated disclosure advisory on specific versions of Philips ultrasound software applications.
Philips lists the HeartStart Intrepid Monitor/Defibrillator (867172), not sold in the US, in its June 18, 2020 advisory on Ripple20, 19 vulnerabilities in the Treck TCP/IP stack.
CISA advisory ICSMA-20-163-01 covers CVE-2020-12023 (CWE-532, CVSS 2.0): Philips IntelliBridge Enterprise B.12 and prior logs unencrypted credentials sent by EarlyVue VS30, IntelliVue Guardian and SureSigns VS4 integrations. Philips plans IBE B.13 by the end of Q4 2020.
Philips lists DiamondClean, FlexCare Platinum, Expert Clean and Sonicare Kids connected toothbrushes, the Connected Shaver 7000 and Saeco Gran Baristo Avanti in its February 20, 2020 SweynTooth advisory covering 12 Bluetooth Low Energy CVEs.
Philips lists 26 products, including IntelliSpace Portal Workstation, PIC iX, eICU eCare Manager and Ingenia MRI, as potentially affected by CVE-2020-0601, the Windows CryptoAPI spoofing flaw known as Curve Ball.
Philips lists about 70 products, including Azurion, Epiq, Affiniti, IQon Spectral CT and PIC iX, in its January 15, 2020 advisory on Windows RD Gateway and Remote Desktop Client flaws CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611.
Philips listed 52 products, including Brilliance and Ingenuity CT, IntelliSpace PACS 4.4, PIC iX and Xper IM, that use Windows 7 or Windows Server 2008 R2 as Microsoft ended extended support on January 14, 2020.
CISA advisory ICSMA-19-353-01 reports inadequate encryption strength (CVE-2019-18263, CVSS v3 5.3) in the Dual WAN router on Philips Veradius Unity, Pulsera and Endura units with the wireless or ViewForum option. Philips offers a router configuration update through customer service.
Philips named EncoreAnywhere and VuePACS as affected by CVE-2019-18935, a .NET deserialization flaw in Progress Telerik UI for ASP.NET AJAX through 2019.3.1023, on December 9, 2019.
CISA advisory ICSMA-19-318-01 covers CVE-2019-18241 (CVSS 6.3) in all versions of the Philips IntelliBridge EC40 and EC80 hubs: the SSH server accepts weak ciphers, enabling session capture and replay. Philips planned a fixed release by the end of Q3 2020.
CISA advisory ICSMA-19-297-01 reports an exposure of resource to wrong sphere (CVE-2019-13546, CVSS v3 6.1) in Philips IntelliSpace Perinatal versions K and prior that lets an attacker escape the application into the Windows operating system. Philips issued mitigation guidance and planned further remediation for end of 2020.
CISA advisory ICSMA-19-255-01 covers a hard-coded FTP password (CVE-2019-13530) and unverified firmware downloads (CVE-2019-13534), each CVSS 6.4, in Philips IntelliVue WLAN Version A firmware A.03.09 and Version B firmware A.01.09. Version C with firmware B.00.31 is not affected.
CISA advisory ICSMA-19-241-02 flags the Philips HDI 4000 Ultrasound System for running on old, unsupported operating systems such as Windows 2000 (CVE-2019-10988, CVSS v3 3.0). Support ended December 31, 2013, so there is no patch.
On August 15, 2019 Philips listed products including IntelliSpace PACS 4.4, IntelliSpace Portal, Xcelera 4.1, Epiq and Affiniti ultrasound in its review of DejaBlue, Remote Desktop Services flaws CVE-2019-1181 and CVE-2019-1182.
On August 1, 2019 Philips named products including Achieva, Ingenia and Multiva MR, BrightView SPECT, HDI 3000 and 3500, and the Smart-hopping Access Point Controller for MX40 in its advisory on the Urgent/11 VxWorks IPnet vulnerabilities.
CISA advisory ICSMA-19-192-01 covers CVE-2019-10968 (CWE-477, CVSS 1.9), a use of an obsolete function in all versions of the Philips Holter 2010 Plus that may allow unpurchased system options to be enabled. Philips reported it.
CISA advisory ICSMA-19-120-01 (Update A) covers cross-site scripting (CVE-2019-6562, CVSS 4.1) and information exposure (CVE-2019-13557, CVSS 4.3) in Philips Tasy EMR 3.01.1744 and prior and Tasy WebPortal 3.02.1757 and prior. Tasy EMR 3.03.1745 and WebPortal 3.03.1758 fix them.
CISA advisory ICSMA-18-340-01 covers CVE-2018-19001 (CWE-326, CVSS v3 3.5), inadequate encryption strength in all versions of the Philips HealthSuite Health Android app. Philips planned a fixed release in the first quarter of 2019.
CISA advisory ICSMA-18-312-01 reports default credentials and missing authentication in third-party software inside all versions of Philips iSite and IntelliSpace PACS (CVE-2018-17906, CVSS v3 6.3). Philips offers no fixed version and points to a managed service environment.
Philips disclosed unencrypted communication vulnerabilities in e-Alert service units up to and including R2.1 on August 30, 2018. An attacker on the same subnet could affect contact details, integrity and availability.
CISA advisory ICSMA-18-233-01 reports uncontrolled resource consumption (CVE-1999-0103, CVSS v3 5.7) in Philips IntelliVue Information Center iX B.02. Multiple initial UDP requests can make the operating system unresponsive; Philips planned a patch by the end of November 2018.
Philips issued an advisory on August 16, 2018 on potential security vulnerabilities in PageWriter TC10, TC20, TC30, TC50 and TC70 cardiograph systems.
CISA advisory ICSMA-18-228-01 lists CVE-2018-14799 (input validation, CVSS v3 5.9) and CVE-2018-14801 (hard-coded credentials, CVSS v3 6.1) in Philips PageWriter TC10, TC20, TC30, TC50 and TC70 cardiographs on software before May 2018. Philips scheduled a fix for the third quarter of 2020.
CISA advisory ICSMA-18-226-01 reports improper privilege management (CVE-2018-14789, CVSS v3 4.2) in Philips IntelliSpace Cardiovascular 3.1 and earlier and Xcelera 4.1 and earlier. ISCV 3.1 fixes 2.x installs; ISCV 3.2 was scheduled for October 2018.
CISA advisory ICSMA-18-156-01 covers CVE-2018-10597, CVE-2018-10599 and CVE-2018-10601 in Philips IntelliVue patient monitors and Avalon fetal/maternal monitors, allowing unauthenticated memory read and write and a stack overflow from the same subnet. Philips committed to a patch for supported versions and an upgrade path for all versions.
CISA advisory ICSMA-18-137-02 reports an information exposure flaw (CVE-2018-8863, CVSS v3 5.9) in Philips EncoreAnywhere APAC 2.36.3.3 and earlier. Philips put mitigations in place and targeted full implementation by September 2018.
CISA advisory ICSMA-18-123-01 covers three local flaws in Philips Brilliance CT scanners, including hard-coded credentials (CVE-2018-8857, CVSS 8.4) and kiosk escape to the Windows OS (CVE-2018-8853, CVE-2018-8861). Philips fixed the credentials in Brilliance iCT 4.x and above.
Philips disclosed a low-risk vulnerability on May 1, 2018 in Brilliance 64 2.6.2 and below, Brilliance iCT 4.1.6 and below, Brilliance iCT SP 3.2.4 and below, Brilliance CT Big Bore 2.3.5 and below, and MX8000 Dual EXP (CWE-798 only).
Philips confirmed on March 28, 2018 that iSite and IntelliSpace PACS contain vulnerabilities that under certain conditions could compromise patient confidentiality, system integrity and availability.
CISA advisory ICSMA-18-086-01 covers improper authentication (CVE-2018-5451) and missing encryption of sensitive data (CVE-2018-7498) in Philips Alice 6 R8.0.3 and prior. Philips planned to update devices to R8.0.4 in Q1 2019.
Philips disclosed hard-coded credentials and cleartext storage and transmission of patient health information in the Alice 6 Polysomnography System on March 26, 2018, rating the issue low risk.
CISA advisory ICSMA-18-058-02 lists 35 vulnerabilities in all Philips IntelliSpace Portal 7.0.x and 8.0.x versions, including CVE-2018-5474, CVE-2018-5468 and CVE-2018-5472 at CVSS v3 9.8 and a block of Windows SMBv1 flaws. Philips posts tested patches and mitigating controls on InCenter.
CISA advisory ICSMA-18-025-01 covers CVE-2018-5438 (CVSS 6.7), insufficient session expiration in Philips IntelliSpace Cardiovascular 2.3.0 and prior when run in KIOSK mode with an EMR and Windows authentication. ISCV 3.1 adds an option to drop Windows authentication.
CISA advisory ICSMA-17-318-01 covers CVE-2017-14111 (CVSS 7.2), cleartext credentials in system files of Philips IntelliSpace Cardiovascular 2.3.0 and earlier and Xcelera R4.1L1 and earlier. Philips is issuing hotfixes under field change order FCO83000202.
CISA advisory ICSMA-17-255-01 describes two exception handling flaws (CVE-2017-9657 and CVE-2017-9658, CVSS v3 6.5 each) in Philips IntelliVue MX40 Patient Worn Monitors (WLAN only) before B.06.18 that can leave a monitor silent while the central station thinks it is alarming locally. Philips planned a further software update in 2017.
CISA advisory ICSMA-17-229-01 covers hard-coded database credentials (CVE-2017-9656, CVSS 9.1) and cleartext stored logins (CVE-2017-9654) in Philips DoseWise Portal 1.1.7.333 and 2.1.1.3069. Philips is supporting 1.1.7.333 users to change and encrypt all stored passwords.
On July 5, 2017 Philips named Diagnostic Site Server 9.x and above under CVE-2017-9248, a Telerik UI for ASP.NET AJAX flaw in versions R2 2017 SP1 and prior that fails to protect encryption keys.
On May 15, 2017, Philips published guidance on the WannaCry ransomware campaign and named IntelliSpace Portal Workstation IX (ISP IX) and IntelliSpace Event Management (IEM) in the notice.
On July 14, 2016, Philips published vulnerability information for the Xper-IM Connect system after security researchers contacted the company in the second quarter of 2016.
On February 21, 2013, Philips Healthcare said researchers had presented a vulnerability in a system component of the Philips Xper Information Management System and that a software update would follow validation.
Philips products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.
| Product | Device type | Attributes | Matched advisories |
|---|---|---|---|
| Image Management V15 | System, Image Processing, Radiological | 28 | 51 |
| aetherSlide | Digital Pathology Image Viewing And Management Software | 15 | 29 |
| Cardiologs Holter Platform | Electrocardiograph | 20 | 26 |
| CT Collaboration Live | System, Image Processing, Radiological | 19 | 23 |
| Zenition 90 | Interventional Fluoroscopic X-Ray System | 18 | 13 |
| Zenition 70 | Interventional Fluoroscopic X-Ray System | 29 | 11 |
| Radiography 7000 M | System, X-Ray, Mobile | 19 | 9 |
| Multimodality Simulation Workspace (MM Sim) | System, Planning, Radiation Therapy Treatment | 17 | 5 |
| Nasal Alar SpO2 Sensor (989803205381) | Oximeter | 6 | 5 |
| Philips IntelliSpace Cardiovascular | System, Image Processing, Radiological | 47 | 5 |
| Precise Position | System, X-Ray, Tomography, Computed | 7 | 5 |
| ProxiDiagnost N90 | System, X-Ray, Fluoroscopic, Image-Intensified | 24 | 5 |
| MR 5300 and MR 7700 R11 MR Systems | System, Nuclear Magnetic Resonance Imaging | 11 | 4 |
| Philips Radiology Smart Assistant | System, X-Ray, Stationary | 8 | 4 |
| DigitalDiagnost | System, X-Ray, Stationary | 21 | 2 |
| UroNav 4 | System, Image Processing, Radiological | 5 | 2 |
| DreamWear Silicone Pillows Mask | Ventilator, Non-Continuous (Respirator) | 1 | 1 |
| Philips Avent Natural Care Hands-free Wearable Electric Breast Pump | Pump, Breast, Powered | 16 | 1 |
| 5000 Compact Series Ultrasound Systems | System, Imaging, Pulsed Doppler, Ultrasonic | 4 | 0 |
| Achieva, Ingenia, Ingenia CX, Ingenia Elition and Ingenia Ambition MR | System, Nuclear Magnetic Resonance Imaging | 13 | 0 |
| Achieva, Intera, Ingenia, Ingneia CX, Ingenia Elition, and Ingenia | System, Nuclear Magnetic Resonance Imaging | 15 | 0 |
| Achieva; Intera; Ingenia 1.5T; Ingenia 3.0T; Ingenia 1.5T CX; Ingenia | System, Nuclear Magnetic Resonance Imaging | 5 | 0 |
| AltaTrack Equipment R1.2, AltaTrack Guidewire, AltaTrack 3D Hub | Computer, Diagnostic, Programmable | 3 | 0 |
| Altis Full Face Mask | Ventilator, Non-Continuous (Respirator) | 3 | 0 |
| AV Cardiac CT | System, X-Ray, Tomography, Computed | 7 | 0 |
| AV Vascular | Automated Radiological Image Processing Software | 8 | 0 |
| AV Viewer | System, Image Processing, Radiological | 15 | 0 |
| Avalon CL Fetal & Maternal (F&M) Pod (866488) | System, Monitoring, Perinatal | 9 | 0 |
| Azurion R2.1 | Interventional Fluoroscopic X-Ray System | 11 | 0 |
| Azurion R3.1 | Interventional Fluoroscopic X-Ray System | 12 | 0 |
| ClarifEye R1.0, ClarifEye Needle | Interventional Fluoroscopic X-Ray System | 5 | 0 |
| CombiDiagnost R90 | System, X-Ray, Fluoroscopic, Image-Intensified | 23 | 0 |
| CT 5300 | System, X-Ray, Tomography, Computed | 8 | 0 |
| DigitalDiagnost C50 | System, X-Ray, Stationary | 12 | 0 |
| DigitalDiagnost C90 | Solid State X-Ray Imager (Flat Panel/Digital Imager) | 17 | 0 |
| dS Base 1.5T | Coil, Magnetic Resonance, Specialty | 1 | 0 |
| DuraDiagnost | System, X-Ray, Stationary | 13 | 0 |
| EchoNavigator | System, Image Processing, Radiological | 6 | 0 |
| EchoNavigator R4.0 | System, Image Processing, Radiological | 7 | 0 |
| EchoNavigator R5.0 | Automated Radiological Image Processing Software | 7 | 0 |
| Extron 3; Extron 5; Extron 7 | Interventional Fluoroscopic X-Ray System | 12 | 0 |
| Ingenia 3.0T | System, Nuclear Magnetic Resonance Imaging | 7 | 0 |
| Ingenia Elition and MR 7700 MR Systems | System, Nuclear Magnetic Resonance Imaging | 7 | 0 |
| Ingenia Elition R5.7.1 SP4 MR Systems | System, Nuclear Magnetic Resonance Imaging | 9 | 0 |
| Ingenia, Ingenia CX, Ingenia Elition S/X, Ingenia Ambition S/X, | System, Nuclear Magnetic Resonance Imaging | 15 | 0 |
| Ingenia, Ingenia CX, Ingenia Elition, Ingenia Ambition, BlueSeal, MR | System, Nuclear Magnetic Resonance Imaging | 11 | 0 |
| Ingenia, Ingenia CX, Ingenia Elition, Ingenia Ambition, MR 5300 | System, Nuclear Magnetic Resonance Imaging | 6 | 0 |
| IntraSight Plus | System, Imaging, Pulsed Echo, Ultrasonic | 24 | 0 |
| IQon Spectral CT | System, X-Ray, Tomography, Computed | 13 | 0 |
| KODEX - EPD System 1.5.0 | Computer, Diagnostic, Programmable | 3 | 0 |
| Lumify Diagnostic Ultrasound System | System, Imaging, Pulsed Doppler, Ultrasonic | 15 | 0 |
| Lumify Diagnostic Ultrasound System | System, Imaging, Pulsed Doppler, Ultrasonic | 15 | 0 |
| LumiGuide Equipment R2.1; LumiGuide Wire; LumiGuide 3D Hub | Computer, Diagnostic, Programmable | 1 | 0 |
| LumiGuide Wire; LumiGuide Equipment R2.0; LumiGuide 3D Hub | Computer, Diagnostic, Programmable | 6 | 0 |
| Magneto Nasal Mask | Ventilator, Non-Continuous (Respirator) | 1 | 0 |
| MR 5300 | System, Nuclear Magnetic Resonance Imaging | 8 | 0 |
| MRCAT brain | System, Planning, Radiation Therapy Treatment | 3 | 0 |
| MRCAT Head & Neck | System, Planning, Radiation Therapy Treatment | 6 | 0 |
| Philips CT 3500 | System, X-Ray, Tomography, Computed | 4 | 0 |
| Philips iCT CT system | System, X-Ray, Tomography, Computed | 10 | 0 |
| Philips Incisive CT | System, X-Ray, Tomography, Computed | 10 | 0 |
| Philips IntelliSite Pathology Solution | Whole Slide Imaging System | 10 | 0 |
| Philips IntelliSite Pathology Solution 5.1 | Whole Slide Imaging System | 9 | 0 |
| Philips IntelliVue GuardianSoftware | Display, Cathode-Ray Tube, Medical | 14 | 0 |
| Philips Lumea IPL | Light Based Over-The-Counter Hair Removal | 4 | 0 |
| Philips VSC-MEDlib | Monitor, Breathing Frequency | 6 | 0 |
| ProxiDiagnost N90 / Precision CRF | System, X-Ray, Fluoroscopic, Image-Intensified | 13 | 0 |
| ROCC Console | System, Image Processing, Radiological | 7 | 0 |
| SmartCT (R3.0 | Interventional Fluoroscopic X-Ray System | 8 | 0 |
| SmartCT R1.0 | Interventional Fluoroscopic X-Ray System | 8 | 0 |
| Spectral CT | System, X-Ray, Tomography, Computed | 11 | 0 |
| Spectral CT | System, X-Ray, Tomography, Computed | 11 | 0 |
| Spectral CT 7500 RT | System, X-Ray, Tomography, Computed | 6 | 0 |
| Spectral CT on Rails | System, X-Ray, Tomography, Computed | 17 | 0 |
| Spectral CT Verida Family | System, X-Ray, Tomography, Computed | 6 | 0 |
| StentBoost Mobile | Interventional Fluoroscopic X-Ray System | 4 | 0 |
| Therapy Mask 3100 NC/SP | Ventilator, Non-Continuous (Respirator) | 1 | 0 |
| Vereos PET/CT | System, Tomography, Computed, Emission | 6 | 0 |
| Zenition 30 | Interventional Fluoroscopic X-Ray System | 23 | 0 |