Vulnerability

Canon Medical lists Alphenix, CT TSX and MRT systems as affected by DejaBlue RDP flaws

MedDevice Cyber Staff · Aug 20 · 3 min read · Via Canon Medical DejaBlue advisory

Canon Medical revised its DejaBlue advisory on August 20, 2019. The pre-authentication Remote Desktop Services remote code execution vulnerabilities, CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, CVE-2019-1223 and CVE-2019-1226, affect listed Canon XR/VL, CT and MR imaging products and InnerVision service processors.

Listed products are the Alphenix V8.x Angio Workstation on Windows 7, the CT TSX series with the SUREXtension option (COT-49D), the MRT series on Windows 7, and the InnerVision Service Processor and Service Processor Firewall on Windows 7 and 10. Ultrasound products that block port 3389 are mitigated.

Pre-authentication and wormable is the worst pairing for a modality network. Any imaging host answering on 3389 should be patched or closed before anything else on the list.

Are you a representative of Canon Medical? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Patch the listed Alphenix, CT TSX, MRT and InnerVision systems for the DejaBlue CVEs through Canon service. Close TCP 3389 to every imaging host that does not need inbound Remote Desktop.

Find exposed RDP. Scan the imaging network for hosts answering on TCP 3389.
Apply Canon's patches. Install the Microsoft updates Canon approves for each listed product.
Close port 3389. Block inbound Remote Desktop to modalities that do not require it.
Enable NLA where allowed. Ask Canon whether Network Level Authentication can be turned on for remaining RDP use.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Alphenix Angio Workstation

PID-23 Named operating system

MRT series

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Canon Medical products are affected by DejaBlue?

Canon Medical lists the Alphenix V8.x Angio Workstation (Windows 7), CT TSX series with SUREXtension option (COT-49D), MRT series (Windows 7) and InnerVision service processors as affected by DejaBlue, CVE-2019-1181 and CVE-2019-1182.

Are Canon ultrasound systems affected by DejaBlue CVE-2019-1182?

Canon Medical says ultrasound products that block port 3389 are mitigated against the DejaBlue Remote Desktop Services vulnerabilities.

← Back to Vulnerabilities