Vulnerability

Philips Gemini PET/CT systems write sensitive data to removable media without access control

MedDevice Cyber Staff · Mar 25 · 2 min read · Via CISA ICSMA-21-084-01

CISA published advisory ICSMA-21-084-01 on March 25, 2021, for CVE-2021-27456 in the Philips Gemini PET/CT family. The advisory lists 11 models: Gemini Dual (882160), Gemini 16 Slice (882300), Gemini GXL 6, 10 and 16 Slice (882390, 882400, 882410), GEMINI LXL (882412), TruFlight Select PET/CT (882438), Gemini TF 16 and TF 64 with TOF Performance (882470, 882471), Gemini TF Ready (882473) and Gemini TF Big Bore (882476). Jean George of the nuclear medicine department at CHU UCL Namur reported it.

The weakness is storage of sensitive data in a mechanism without access control (CWE-921). The software stores sensitive information on removable media that has no built-in access control, and CISA's risk evaluation says that could expose patient information.

The CVSS v3 score is 2.4, with a physical vector and low confidentiality impact only. The score is low because an attacker needs the media in hand, and removable media is designed to leave the room. Encrypt anything patient-identifiable that a device writes to a disk someone can carry away.

Philips published guidance and mitigations with the advisory and directs questions about specific Gemini installations to its service support team.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Follow the guidance and mitigations in the Philips advisory for the Gemini PET/CT family and contact Philips service support for installation-specific questions. The advisory names no software fix. Treat any removable media written by these systems as carrying patient information and control it physically.

Apply the Philips guidance. Read the Philips advisory for CVE-2021-27456 and apply its mitigations to each Gemini system.
Control removable media. Track, store and wipe media written by Gemini scanners as you would any record containing patient information.
Encrypt media in new designs. Device makers should encrypt sensitive data before it reaches any removable storage.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Removable media

Contributing

Handles patient data

Gemini PET/CT Family

PID-123 Removable media Handles patient data

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
IonicRF Generator	Abbott	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Versana Active	GE HealthCare	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Versana Premier	GE HealthCare	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Endoflip 300 System	Medtronic	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Evis EUS Endoscopic Ultrasound Center Olympus EU-ME3	Olympus	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Optomed Smartscope M5 with Optomed Smartscope FA	Optomed	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same property (MITRE EMB3D)PID-123	No feedback feed from manufacturer
Visera Elite III Video System Center Olympus OTV-S700	Olympus	Same signals	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
ID Now Instrument, ID Now Influenza A & B 2, ID NOW Strep A 2	Abbott	Exposed to the same EMB3D threatTID-111	No feedback feed from manufacturer
Embryo Predict	Alife Health	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
IntraOp Alignment System	Alphatec Spine	Exposed to the same EMB3D threatTID-111	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer

49 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2021-27456 in the Philips Gemini PET/CT family?

CVE-2021-27456 (CWE-921, CVSS v3 2.4) is a weakness in Philips Gemini PET/CT family systems, including Gemini Dual, GXL, LXL, TF and TruFlight Select models, where the software stores sensitive information on removable media without built-in access control. CISA disclosed it in ICSMA-21-084-01 on March 25, 2021.

Does CVE-2021-27456 expose patient data on Philips Gemini PET/CT scanners?

It can. CISA advisory ICSMA-21-084-01 says exploitation of CVE-2021-27456 involving removable media could allow access to sensitive information, including patient information, on Philips Gemini PET/CT family systems. An attacker needs physical access to the media.

← Back to Vulnerabilities