Vulnerability

Philips lists IntelliSpace PACS and ECG systems in ESXi OpenSLP ransomware notice

MedDevice Cyber Staff · Feb 6 · 2 min read · Via Philips product security advisories 2023

On February 6, 2023, Philips posted a notice on the ransomware attacks in Europe that exploited CVE-2021-21974, a heap-overflow vulnerability in the OpenSLP service on VMware ESXi hypervisors. The products listed are the IntelliSpace ECG Management System (IECG), IntelliSpace PACS, Trace Master Vue 3.6 and Universal Data Manager 2 (UDM).

The bug was two years old when the ransomware crews picked it up. Philips split its mitigations by deployment, starting with software only products that run on customer owned operating systems, where the hypervisor patch falls to the hospital.

A clinical archive on an unpatched ESXi host inherits the host's exposure. Close OpenSLP on every hypervisor that carries a clinical workload.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Patch or disable OpenSLP on every VMware ESXi host that runs IntelliSpace ECG, IntelliSpace PACS, Trace Master Vue 3.6 or Universal Data Manager 2. Where the platform is customer owned, the hospital owns the hypervisor fix; confirm the deployment model with Philips first.

Inventory hypervisors. Find each ESXi host that carries a listed Philips workload and record its build.
Close OpenSLP. Apply the VMware fix for CVE-2021-21974 or stop the SLP service on hosts that cannot be patched yet.
Block port 427. Keep SLP unreachable from user and internet facing networks at the firewall.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Hospital network

IntelliSpace ECG Management System

Physiological waveform processing

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products were affected by the ESXi OpenSLP ransomware attacks (CVE-2021-21974)?

In a February 6, 2023 notice, Philips listed IntelliSpace ECG Management System, IntelliSpace PACS, Trace Master Vue 3.6 and Universal Data Manager 2 in connection with CVE-2021-21974, the OpenSLP heap overflow in VMware ESXi.

Who patches ESXi under Philips software only products?

For Philips software only products on customer owned operating systems, the February 6, 2023 notice on CVE-2021-21974 places the hypervisor and operating system under the customer's control, so the hospital applies the VMware fix.

← Back to Vulnerabilities