A .NET Remoting port left wide open on an imaging workstation

MedDevice Cyber Staff · Apr 10 · 3 min read · Via Philips Product Security

Philips published an advisory on IntelliSpace Portal, version 12 and prior, and Advanced Visualization Workspace. CVE-2025-3425, CVSS v4 7.3, deserialization of untrusted data.

Deserialization turns a stream of bytes back into live objects a program can use, and the danger appears when the stream comes from an untrusted source. If the receiving code will reconstruct whatever type the data names, a crafted payload can coax the program into building objects whose creation runs attacker-chosen code. The weakness is less a single bad line than a design that trusts the wire to describe what should be built.

The specifics are a security-engineer bingo card: .NET Remoting exposed on TCP port 755, with TypeFilterLevel set to Full. That combination lets an attacker on the network send a serialized payload the workstation will happily instantiate, and code execution follows. Full TypeFilterLevel on a remoting endpoint has been known-dangerous for over a decade. It is the setting the security guides tell you never to use on an untrusted channel.

The mechanism at issue belongs to an earlier era of application development, kept because imaging platforms live for many years and their internal plumbing is costly to replace. Rewriting a communication layer that works, on a validated clinical product, invites retesting and integration risk, so the old approach survives release after release. That inertia is why weaknesses recognized as dangerous long ago persist in medical software.

An imaging workstation is not a passive viewer. It sits on the clinical network, holds patient studies, and often carries the operator's credentials to the systems around it. Code execution on such a machine hands an intruder a foothold with a clear line of sight to imaging data and to the accounts that move it, reached over the network without anyone touching the device.

If you still ship .NET Remoting, that is a migration, not a hardening task. Deserialization of attacker-controlled data is remote code execution waiting for a payload, and this one shipped in imaging workstations.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips flagged deserialization of untrusted data in IntelliSpace Portal and Advanced Visualization Workspace: .NET Remoting on TCP 755 with TypeFilterLevel set to Full, a path to remote code execution. Apply the Philips remediation, block the port at the network, and lower the filter level where the component allows.

Apply the Philips advisory. Follow the product security advisory to the remediated configuration.
Block TCP 755. Firewall the .NET Remoting port so untrusted hosts cannot reach the deserialization endpoint.
Constrain deserialization. Where the component allows, drop TypeFilterLevel from Full and restrict the types that can be deserialized.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

net_wired sys_ots_software sys_named_os net_remote_access app_database data_phi use_hospital_net net_cloud

EMB3D

PID-3121

Fix the class in your product

The product turns untrusted bytes into objects without constraint. As the maker, stop deserializing untrusted data into arbitrary types: move to a schema-validated format across trust boundaries, and set any framework type filter to its most restrictive value.

Allow-list types. Validate structure and allow-list expected types before constructing anything.
Restrict the framework. On .NET Remoting set TypeFilterLevel to Low, or replace remoting with an authenticated schema-checked API.
Block the endpoint. Firewall the deserialization port so untrusted hosts cannot reach it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-3425 in Philips IntelliSpace Portal?

Deserialization of untrusted data, CVSS v4 7.3, in IntelliSpace Portal version 12 and prior and Advanced Visualization Workspace. .NET Remoting is exposed on TCP port 755 with TypeFilterLevel set to Full.

Why is .NET Remoting with Full TypeFilterLevel dangerous?

It lets a network attacker send a serialized payload the workstation instantiates, and code execution follows. The setting has been documented as unsafe on untrusted channels for over a decade, so the real fix is migrating off .NET Remoting.

← Back to Vulnerabilities