Vulnerability

Philips lists IntelliSpace PACS, Vue PACS and ten more under Windows RPC flaw CVE-2022-26809

MedDevice Cyber Staff · Apr 26 · 3 min read · Via Philips product security advisories, 2022 archive

Philips published an advisory on April 26, 2022, for CVE-2022-26809, a critical remote code execution vulnerability in the Remote Procedure Call Runtime library of Microsoft Windows. Twelve product entries are listed, including IntelliSpace PACS, VUE PACS 12.1.5, 12.2.1, 12.2.5 and 12.2.8, VUE RIS 11.3 and 11.5, IntelliSpace Portal Server 10.0, 11.0 and 12.0, Universal Data Manager, UroNav and PICiX (all versions).

The list also covers CareEvent (B.x and C.x), Data Warehouse Connect, ISP Enterprise Concerto 11.0 and SensaVue. Successful exploitation could allow a remote, unauthenticated attacker to take control of the system.

RPC runs on every Windows host, and remote unauthenticated code execution in it is the kind of flaw worms get built on. Imaging archives and monitoring gateways on flat hospital networks are where one would spread first.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's CVE-2022-26809 update to every listed Philips product as Philips validates it. Until then, block inbound RPC and SMB ports at the segment boundary for imaging and monitoring hosts.

Patch through Philips. Install the April 2022 Windows update on IntelliSpace PACS, VUE PACS, VUE RIS, PICiX and the other listed products once validated.
Block RPC at the edge. Deny inbound RPC from outside each clinical segment.
Segment imaging hosts. Keep PACS, RIS and monitoring gateways on separate VLANs with explicit allow rules.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Wired network

IntelliSpace PACS

Named operating system

VUE PACS

Named operating system

VUE RIS

Named operating system

IntelliSpace Portal Server

Named operating system

Universal Data Manager

Named operating system

UroNav

Named operating system

PICiX

Named operating system

CareEvent

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2022-26809?

Philips listed IntelliSpace PACS, VUE PACS 12.1.5 to 12.2.8, VUE RIS 11.3 and 11.5, IntelliSpace Portal Server 10.0 to 12.0, Universal Data Manager, UroNav, PICiX, CareEvent, Data Warehouse Connect, ISP Enterprise Concerto 11.0 and SensaVue on April 26, 2022, for CVE-2022-26809.

How serious is the Windows RPC vulnerability CVE-2022-26809 for Philips PACS?

Philips called CVE-2022-26809 critical and said successful exploitation could allow a remote, unauthenticated attacker to take control of the system. IntelliSpace PACS and VUE PACS were among the products listed on April 26, 2022.

Is Philips PICiX affected by CVE-2022-26809?

Yes. Philips listed PICiX (all versions) in its April 26, 2022 advisory on CVE-2022-26809 in the Windows RPC runtime.

← Back to Vulnerabilities