Vulnerability

Philips names Capsule Support Access Tool and Respilink in PTC Axeda Access:7 review

MedDevice Cyber Staff · Mar 8 · 2 min read · Via Philips product security advisories, 2022 archive

Philips posted an advisory on March 8, 2022, naming Capsule Support Access Tool and Respilink in connection with Access:7, a set of vulnerabilities affecting all versions of PTC's Axeda Agent and Axeda Desktop Server for Windows. A CISA advisory on the issues prompted the notice.

Axeda Agent and Axeda Desktop Server are remote access connectivity software used as part of a cloud-based IoT platform. Inside a medical product, an agent like that is the vendor's service channel, a path from outside the hospital to the device by design.

Remote service agents deserve the same scrutiny as the device's own code, and the first audit question is which ones ship enabled.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Access:7 affects all versions of PTC Axeda Agent and Axeda Desktop Server. Ask Philips for the remediation for Capsule Support Access Tool and Respilink, and disable or firewall the remote access agent where the service workflow allows.

Find the agents. Locate every host running Axeda components for Capsule Support Access Tool or Respilink.
Get the Philips fix. Request the updated components or configuration guidance from Philips service.
Restrict remote access. Allow the agent outbound only to the vendor endpoint and enable it only during service sessions.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Remote access Off-the-shelf software

Contributing

Cloud connectivity

Capsule Support Access Tool

Remote access Cloud connectivity

Respilink

Remote access Cloud connectivity

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products use PTC Axeda affected by Access:7?

Philips named Capsule Support Access Tool and Respilink on March 8, 2022, in connection with the Access:7 vulnerabilities affecting all versions of PTC's Axeda Agent and Axeda Desktop Server for Windows.

What is Axeda Agent in Philips Respilink?

Axeda Agent and Axeda Desktop Server are remote access connectivity software used as part of a cloud-based IoT platform. Philips listed Respilink and Capsule Support Access Tool in its March 8, 2022 Access:7 advisory.

← Back to Vulnerabilities