Vulnerability

Carestream patches Axeda clients behind Smart Link remote management for Access:7

MedDevice Cyber Staff · Mar 8 · 3 min read · Via Carestream CARESTREAM-2022-01 advisory

Carestream Health published advisory CARESTREAM-2022-01 on March 8, 2022, covering the PTC Axeda Access:7 vulnerabilities, CVE-2022-25246 through CVE-2022-25252. Carestream uses the PTC Axeda client for Smart Link Remote Management Services, and most installations used vulnerable Axeda versions prior to 6.9.2.

Affected are DirectView, ImageView, DryView, Image Suite and MyVue Center Kiosk systems shipped or updated since 2012 with an Axeda client before 6.9.2. Only devices actively connected to Smart Link RMS are impacted.

Carestream validated security updates and reports it remotely patched more than 99 percent of impacted devices by March 10, 2022.

The same remote channel that carried the risk also delivered the fix in two days. The units that stayed unpatched are the ones that matter now.

Are you a representative of Carestream Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Confirm with Carestream that each Smart Link RMS connected system now runs Axeda 6.9.2 or later. Units that Carestream could not reach remotely need a manual update.

Verify the Axeda version. Check that every connected DirectView, ImageView, DryView, Image Suite and MyVue Center Kiosk runs Axeda 6.9.2 or later.
Chase the stragglers. Ask Carestream which of your units were not in the remotely patched group.
Restrict the RMS channel. Allow Smart Link traffic only to Carestream's service endpoints.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software Remote access

Smart Link Remote Management Services client

Remote access Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Carestream products are affected by the Axeda Access:7 vulnerabilities?

Carestream advisory CARESTREAM-2022-01 lists DirectView, ImageView, DryView, Image Suite and MyVue Center Kiosk systems shipped or updated since 2012 with an Axeda client before 6.9.2 and connected to Smart Link RMS.

Has Carestream patched the Access:7 Axeda flaws?

Carestream says it validated security updates and remotely patched more than 99 percent of impacted devices by March 10, 2022.

Are Carestream devices not connected to Smart Link RMS affected by Access:7?

No. Carestream says only devices actively connected to Smart Link Remote Management Services are impacted by CVE-2022-25246 through CVE-2022-25252.

← Back to Vulnerabilities