Vulnerability

Philips HDI 4000 ultrasound runs on unsupported operating systems such as Windows 2000

MedDevice Cyber Staff · Aug 29 · 2 min read · Via CISA ICSMA-19-241-02

CISA published advisory ICSMA-19-241-02 on August 29, 2019, covering the Philips HDI 4000 Ultrasound System running on old, unsupported operating systems such as Windows 2000. Check Point reported the issue.

CVE-2019-10988 is use of an obsolete function (CWE-477) with a CVSS v3 base score of 3.0. The finding is structural. The system is built on an operating system that no longer receives support, so any unmitigated vulnerability in that operating system could be exploited against the product. The vector requires local access, high complexity and high privileges, and the advisory notes a high skill level is needed.

CISA's risk evaluation is specific about the stakes. Exploitation could expose ultrasound images and compromise image integrity, while patient safety and system availability are not affected. Tampered images are a diagnostic problem even when the machine keeps running.

There is no patch. Philips ended the support life cycle for the HDI 4000 on December 31, 2013, and the systems are no longer sold, updated or supported. The guidance is to limit network access and consider replacing the system with newer technology on a supported operating system. A device whose operating system went out of support years earlier belongs on an isolated segment until it is replaced.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: the Philips HDI 4000 left support on December 31, 2013. Limit network access to the system and plan its replacement with technology on a supported operating system. Until then, treat its images as data that anyone with local access could read or alter.

Isolate the system. Put each HDI 4000 on a restricted network segment with only the connections image transfer requires.
Restrict local access. Exploitation needs local, high-privilege access, so limit who can log on to the system.
Budget the replacement. Philips no longer sells, updates or supports the HDI 4000, so schedule replacement with a system on a supported operating system.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

DICOM or image parsing Handles patient data

HDI 4000 Ultrasound System

PID-23 PID-26 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Is there a patch for CVE-2019-10988 in the Philips HDI 4000 ultrasound?

No. Philips ended support for the HDI 4000 Ultrasound System on December 31, 2013, and no longer updates it. CISA advisory ICSMA-19-241-02, published August 29, 2019, recommends limiting network access and considering replacement with a system on a supported operating system for CVE-2019-10988 (CVSS v3 3.0).

What can an attacker do to a Philips HDI 4000 ultrasound system?

According to CISA advisory ICSMA-19-241-02, exploiting CVE-2019-10988 in the Philips HDI 4000, which runs on old operating systems such as Windows 2000, could expose ultrasound images and compromise image integrity. It does not affect patient safety or system availability, and exploitation needs local access and high skill.

← Back to Vulnerabilities