Vulnerability

Carestream DirectView and ImageView systems affected by BlueKeep and DejaBlue RDP flaws

MedDevice Cyber Staff · May 16 · 3 min read · Via Carestream advisory CARESTREAM-2019-04

Carestream Health published advisory CARESTREAM-2019-04 on May 16, 2019, covering the Remote Desktop Services remote code execution flaws BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 and CVE-2019-1226). The advisory reached revision 4, last revised June 4, 2021.

BlueKeep hits the CR825, CR850, CR950, CR975 and DIRECTVIEW Max, Classic and Elite CR systems on DirectView V5.2 to V5.7 under Windows XP and Windows Embedded Standard 7. The DR 3000, 3500, 7500 and 9500 and the DirectView DRX family are also listed. DejaBlue affects the OnSight 3D Extremity System and ImageView V1.2 and later systems on Windows 10 1607 LTSB.

Both bugs are pre-authentication and wormable over RDP, so one exposed console can seed a whole imaging network. Carestream completed patch qualification. Any CR reader still on Windows XP belongs behind a firewall that drops port 3389 regardless.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Carestream completed patch qualification for the BlueKeep and DejaBlue fixes on the listed DirectView and ImageView systems. Install the qualified Windows updates, and block or disable Remote Desktop where service does not need it. Windows XP based CR readers need network isolation on top of the patch.

Install the qualified patches. Apply the Windows updates Carestream qualified for each DirectView and ImageView system in CARESTREAM-2019-04.
Close RDP. Disable Remote Desktop on consoles that do not need it and block TCP 3389 at the segment boundary.
Isolate legacy readers. Keep Windows XP and Windows Embedded Standard 7 systems on a restricted imaging VLAN.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Remote access

Contributing

Hospital network

DIRECTVIEW CR

PID-23 PID-41 Named operating system Remote access

ImageView

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
4D Integrated Treatment Console	Varian	Same named componentWindows Embedded Standard (= 7)	No feedback feed from manufacturer

Questions & Answers

Are Carestream DirectView systems vulnerable to BlueKeep CVE-2019-0708?

Yes. Carestream advisory CARESTREAM-2019-04, first published May 16, 2019, lists CR825, CR850, CR950, CR975 and DIRECTVIEW CR systems on DirectView V5.2 to V5.7, plus DR and DRX systems, as affected by BlueKeep. Carestream completed patch qualification.

Which Carestream systems does DejaBlue affect?

Carestream advisory CARESTREAM-2019-04 lists the OnSight 3D Extremity System and ImageView V1.2 and later systems on Windows 10 1607 LTSB as affected by DejaBlue (CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, CVE-2019-1226).

← Back to Vulnerabilities