Vulnerability

Accuray warns PTC Axeda flaws could expose TomoTherapy, Radixact and CyberKnife

MedDevice Cyber Staff · Mar 1 · 2 min read · Via Accuray customer security notification: Axeda

Accuray issued a customer security notification in March 2022 on seven vulnerabilities in the PTC Axeda agent and Axeda Desktop Server, CVE-2022-25246 through CVE-2022-25252. Accuray uses Axeda for remote access in TomoTherapy, Radixact, CyberKnife, iDMS and Precision, and the flaws could let an attacker take control of connected systems.

No exploitation had been reported. Accuray is testing an updated remote access agent and recommends firewall, access control, USB, backup and recovery measures in the meantime.

A remote service agent on a radiation therapy system is a direct line to the treatment room. Close it at the firewall until the replacement agent is validated.

Are you a representative of Accuray? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Accuray is testing an updated remote access agent to replace the vulnerable Axeda components. Until it is validated, apply Accuray's firewall, access control, USB, backup and recovery recommendations on TomoTherapy, Radixact, CyberKnife, iDMS and Precision.

Restrict the remote agent. Firewall Axeda remote access traffic to Accuray's service endpoints only.
Tighten local access. Apply access control and USB restrictions as Accuray recommends.
Verify backups. Confirm treatment planning and delivery data backups restore cleanly.
Install the new agent. Deploy Accuray's updated remote access agent once released.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access Off-the-shelf software

Contributing

Therapy delivery

CyberKnife

Remote access Therapy delivery Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Accuray systems are affected by the PTC Axeda vulnerabilities?

Accuray's March 2022 customer security notification lists TomoTherapy, Radixact, CyberKnife, iDMS and Precision, which use the PTC Axeda agent for remote access, as exposed to CVE-2022-25246 through CVE-2022-25252.

Is there a fix for the Axeda flaws on Accuray CyberKnife?

In March 2022 Accuray was testing an updated remote access agent and recommended firewall, access control, USB, backup and recovery measures for CyberKnife and its other affected systems.

← Back to Vulnerabilities