Vulnerability

Philips lists 26 products running Windows under the CryptoAPI spoofing flaw CVE-2020-0601

MedDevice Cyber Staff · Jan 16 · 2 min read · Via Philips security advisory

Philips issued an advisory on January 16, 2020 on CVE-2020-0601, the Windows CryptoAPI spoofing vulnerability also called Curve Ball or NSA Crypt. Philips said it was evaluating its products that use Microsoft operating systems.

The list runs to 26 entries, among them Achieva and Ingenia MRI, IntelliSpace Portal Workstation, IntelliSpace Cardiovascular, the IntelliSpace ECG Management System B.00, PIC iX, IntelliVue Guardian Software, eICU eCare Manager, DoseWise Portal, MobileDiagnost wDR, DigitalDiagnost C90 and EchoNavigator.

A spoofed certificate breaks the trust every signed update and TLS session depends on. On a scanner workstation, that trust is the only thing standing between an update and malware.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Microsoft fix for CVE-2020-0601 to the listed Philips systems only after Philips validates it for each product. Contact the Philips service representative for patch availability by configuration.

Map the 26 products to your fleet. Match Philips' list to installed systems and versions.
Get validated patches. Ask Philips service which systems are cleared for the January 2020 Windows update.
Watch certificate trust. Monitor for unexpected certificates on the affected workstations until patched.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Off-the-shelf software

IntelliSpace Portal Workstation

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2020-0601 Curve Ball?

Philips' January 16, 2020 advisory lists 26 Windows-based products for CVE-2020-0601, including Achieva, Ingenia, IntelliSpace Portal Workstation, IntelliSpace Cardiovascular, PIC iX, IntelliVue Guardian Software, eICU eCare Manager and EchoNavigator.

What is the CryptoAPI spoofing vulnerability CVE-2020-0601?

CVE-2020-0601, also called Curve Ball or NSA Crypt, is a Windows CryptoAPI spoofing vulnerability. Philips evaluated its products that use Microsoft operating systems for impact in an advisory on January 16, 2020.

← Back to Vulnerabilities