Vulnerability

Philips lists eight product lines under Windows CLFS zero day CVE-2025-29824

MedDevice Cyber Staff · Apr 16 · 3 min read · Via Philips product security advisories 2025

On April 16, 2025, Philips posted a notice on CVE-2025-29824, a zero day in the Windows Common Log File System. Philips said it can allow a remote attacker to run arbitrary code on a victim machine.

Eight product lines are listed: Advanced Visualization Workspace 15, IntelliSpace Perinatal, IntelliVue Guardian Software, IntelliSpace Corsium, IntelliVue XDS, ST80i, ECI Event and Device Readiness and IntelliSpace Portal 11/12. Philips policy allows only Philips authorized changes on these systems, so the patch reaches the device through Philips service.

A zero day on a perinatal or early warning workstation is a reason to check who can log on to it this week, before the patch.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Philips validated Windows April 2025 update for CVE-2025-29824 on all eight listed product lines. Limit interactive logons on those hosts until the patch is in.

Pull the product list. Match the listed Philips products against the installed base, including catalogue numbers and versions.
Ask Philips service for the status. Get the validated patch or the interim mitigation for each listed system before applying anything yourself.
Segment the affected hosts. Keep the listed workstations and servers on a clinical VLAN with no direct internet or guest network exposure.
Restrict logons. Limit who can sign in to the listed workstations until the update is applied.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Off-the-shelf software Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-29824?

CVE-2025-29824 is a zero day in the Windows Common Log File System. Philips said on April 16, 2025 that it can allow a remote attacker to run arbitrary code on a victim machine.

Which Philips products are affected by CVE-2025-29824?

Philips listed Advanced Visualization Workspace 15, IntelliSpace Perinatal, IntelliVue Guardian Software, IntelliSpace Corsium, IntelliVue XDS, ST80i, ECI Event and Device Readiness and IntelliSpace Portal 11/12 on April 16, 2025.

← Back to Vulnerabilities