Vulnerability

Philips lists IntelliBridge Enterprise and IntelliVue software under Windows NFS flaw CVE-2022-24491

MedDevice Cyber Staff · Apr 15 · 2 min read · Via Philips product security advisories, 2022 archive

Philips issued an advisory on April 15, 2022, for CVE-2022-24491, a critical remote code execution vulnerability in Microsoft's Network File System protocol. Six products are listed: IntelliBridge Enterprise B.6 to B.16, IntelliSpace Perinatal, IntelliVue Guardian Software, IntelliSpace Concerto 10, 11 and 12, IntelliSpace Portal 10, 11 and 12, and IntelliVue XDS.

Successful exploitation could enable remote code execution. The flaw lives in the Windows NFS server role, so whether a given host is exposed depends on whether that role is enabled.

Check the role before arguing about the patch window. An integration server with NFS switched on for no clinical reason is a fix that needs no validation cycle.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's CVE-2022-24491 update to the listed Philips products as Philips validates it. Where the Windows NFS server role is enabled without a clinical need, ask Philips whether it can be removed.

Check the NFS role. Identify which IntelliBridge Enterprise, IntelliVue and IntelliSpace hosts have NFS enabled.
Patch validated hosts. Install the Windows fix for CVE-2022-24491 per Philips guidance.
Filter NFS traffic. Block NFS ports at the segment boundary for hosts that do not need them.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2022-24491?

Philips listed IntelliBridge Enterprise B.6 to B.16, IntelliSpace Perinatal, IntelliVue Guardian Software, IntelliSpace Concerto 10 to 12, IntelliSpace Portal 10 to 12 and IntelliVue XDS on April 15, 2022, for CVE-2022-24491 in Windows NFS.

What is CVE-2022-24491?

CVE-2022-24491 is a critical remote code execution vulnerability in Microsoft's Network File System protocol. Philips named six products, including IntelliBridge Enterprise and IntelliVue XDS, as related on April 15, 2022.

← Back to Vulnerabilities