Vulnerability

Philips lists HeartStart, IntelliVue and IntelliSpace products as Windows Server 2012 reaches end of life

MedDevice Cyber Staff · Oct 10 · 3 min read · Via Philips product security advisories, 2023 archive

Philips issued a notice on October 10, 2023, as Microsoft ended support for Windows Server 2012 and Windows Server 2012 R2, listing affected products. The list includes HeartStart Event Review 4.2, 4.3 and 5.2, HeartStart Telemedicine 4.2, HeartStart Configure 3.1, HeartStart Data Messenger 4.3.1, IntelliVue Guardian Software E.0x, IntelliVue XDS N.00, N.01, N.02, P.00.00 and P.00.01, and IntelliSpace Perinatal K.00.10, K.00.20, K.00.21 and K.00.22.

IntelliSpace PACS, Holter SW, IntelliSite Pathology Solution, Capsule MDIP, Capsule Surveillance and VSS Dashboard are also named. Microsoft states that after this date the products will no longer receive security updates, non-security updates, bug fixes, technical support or online technical content updates.

Every Windows CVE from here on stacks up on these hosts unpatched. Budget the server migration now, because the device validation timeline will not shrink to fit it.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Windows Server 2012 and 2012 R2 stopped receiving security updates on October 10, 2023. Plan migration of the listed Philips products with Philips service, and compensate with segmentation and access restriction on the remaining hosts.

Inventory 2012 hosts. List every Philips product instance still on Windows Server 2012 or 2012 R2.
Plan the migration. Get the supported upgrade path for each product from Philips service.
Wall off what remains. Restrict inbound connections to remaining 2012 hosts to named clinical peers.
Watch extended updates. Ask Philips whether Microsoft Extended Security Updates are supported for each product.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

HeartStart Event Review

Named operating system

HeartStart Telemedicine

Named operating system

HeartStart Configure

Named operating system

HeartStart Data Messenger

Named operating system

IntelliVue Guardian Software

Named operating system

IntelliVue XDS

Named operating system

IntelliSpace Perinatal

Named operating system

IntelliSpace PACS

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same named componentWindows Server (= 2012)	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (= 2012)	No feedback feed from manufacturer

Questions & Answers

Which Philips products run on Windows Server 2012?

Philips listed HeartStart Event Review, HeartStart Telemedicine, HeartStart Configure, HeartStart Data Messenger, IntelliVue Guardian Software, IntelliVue XDS, IntelliSpace Perinatal, IntelliSpace PACS, Holter SW, IntelliSite Pathology Solution, Capsule MDIP, Capsule Surveillance and VSS Dashboard in its October 10, 2023 Windows Server 2012 end of life notice.

What does Windows Server 2012 end of life mean for Philips IntelliVue XDS?

After October 10, 2023, Windows Server 2012 and 2012 R2 no longer receive security updates, bug fixes or technical support. Philips listed IntelliVue XDS N.00 to P.00.01 among the affected products.

← Back to Vulnerabilities