LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A .NET Remoting port left wide open on an imaging workstation

MedDevice Cyber Staff · Apr 10 · 3 min read · Via Philips Product Security

Philips published an advisory on IntelliSpace Portal, version 12 and prior, and Advanced Visualization Workspace. CVE-2025-3425, CVSS v4 7.3, deserialization of untrusted data.

The specifics are a security-engineer bingo card: .NET Remoting exposed on TCP port 755, with TypeFilterLevel set to Full. That combination lets an attacker on the network send a serialized payload the workstation will happily instantiate, and code execution follows. Full TypeFilterLevel on a remoting endpoint has been known-dangerous for over a decade. It is the setting the security guides tell you never to use on an untrusted channel.

If you still ship .NET Remoting, that is a migration, not a hardening task. Deserialization of attacker-controlled data is remote code execution waiting for a payload, and this one shipped in imaging workstations.

Remediation Desk

Philips flagged deserialization of untrusted data in IntelliSpace Portal and Advanced Visualization Workspace: .NET Remoting on TCP 755 with TypeFilterLevel set to Full, a path to remote code execution. Apply the Philips remediation, block the port at the network, and lower the filter level where the component allows.

Apply the Philips advisory. Follow the product security advisory to the remediated configuration.
Block TCP 755. Firewall the .NET Remoting port so untrusted hosts cannot reach the deserialization endpoint.
Constrain deserialization. Where the component allows, drop TypeFilterLevel from Full and restrict the types that can be deserialized.

Sources

Philips Product Security ↗

Questions & Answers

What is CVE-2025-3425 in Philips IntelliSpace Portal?

Deserialization of untrusted data, CVSS v4 7.3, in IntelliSpace Portal version 12 and prior and Advanced Visualization Workspace. .NET Remoting is exposed on TCP port 755 with TypeFilterLevel set to Full.

Why is .NET Remoting with Full TypeFilterLevel dangerous?

It lets a network attacker send a serialized payload the workstation instantiates, and code execution follows. The setting has been documented as unsafe on untrusted channels for over a decade, so the real fix is migrating off .NET Remoting.

← Back to Vulnerabilities