Vulnerability

Carestream lists CR, Image Suite, DRX-Excel and OMNI systems as exposed to PrintNightmare

MedDevice Cyber Staff · Jul 15 · 2 min read · Via Carestream CARESTREAM-2021-05 advisory

Carestream Health published advisory CARESTREAM-2021-05 on July 15, 2021, covering the Print Nightmare Print Spooler flaws: CVE-2021-1675, CVE-2021-34527, CVE-2021-34481, CVE-2021-36936 and CVE-2021-36947. The advisory was revised through January 5, 2022.

Impacted products are the CR825, CR850, CR950, CR975 and DIRECTVIEW Max CR System on DirectView V5.x, Image Suite V4 Systems on Windows 10 Professional, CRescendo Classic, CRescendo WAIV Series, DRX-Excel and OMNI, with security updates or mitigations available. ImageView DRX systems are not impacted because Print Spooler is disabled by default.

ImageView DRX is the template. Services that a radiography console does not use should ship disabled.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the security updates or mitigations Carestream lists in CARESTREAM-2021-05 for each impacted CR, Image Suite, CRescendo, DRX-Excel and OMNI system. Where printing is not needed, ask Carestream whether Print Spooler can be disabled as it is on ImageView DRX.

Match products to fixes. Find the update or mitigation the advisory names for each impacted system.
Apply the updates. Install Carestream's validated security updates.
Disable unused spoolers. Turn off Print Spooler where Carestream confirms it is safe.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Image Suite

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Carestream products are affected by PrintNightmare?

Carestream advisory CARESTREAM-2021-05 lists CR825, CR850, CR950, CR975, DirectView Max CR, Image Suite V4 (Windows 10 Professional), CRescendo Classic, CRescendo WAIV Series, DRX-Excel and OMNI as impacted by Print Spooler flaws including CVE-2021-34527.

Is Carestream ImageView DRX affected by CVE-2021-34527?

No. Carestream says ImageView DRX systems are not impacted because Print Spooler is disabled by default.

← Back to Vulnerabilities