Vulnerability

Philips lists IntelliVue Guardian, IntelliBridge and PICiX under Windows IKE flaw CVE-2022-21849

MedDevice Cyber Staff · Mar 23 · 3 min read · Via Philips product security advisories, 2022 archive

Philips issued an advisory on March 23, 2022, for CVE-2022-21849, a critical remote code execution vulnerability in the IKE Extension component of Microsoft Windows. Listed products include CareEvent C.0x, IntelliSpace Perinatal K.x, IntelliVue Guardian Software E.0x, PICiX C.0x, FocalPoint A.0 and A.01, IntelliBridge Enterprise B.09 to B.15 and IntelliSpace Portal Server 11.0 and 12.0.

Data Warehouse Connect, IntelliSpace Portal Enterprise 12.0 and ISP Enterprise Concerto 12.0 complete the list. Microsoft had already released a patch in its January security update, about two months before the Philips notice.

Two months between a Microsoft fix and a device maker's applicability list is the window hospitals actually work in, and validated patch lists are what shorten it.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft patched CVE-2022-21849 in January 2022. Apply the update to the listed Philips products through Philips-validated channels, and block IKE traffic to hosts that do not use IPsec.

Apply the January update. Install the CVE-2022-21849 fix on IntelliVue Guardian, IntelliBridge Enterprise, PICiX and the other listed hosts as Philips validates it.
Filter IKE. Block UDP 500 and 4500 to clinical hosts that do not terminate IPsec.
Track lag time. Record the gap between Microsoft release and Philips validation for each product.
Confirm versions. Match installed versions against the Philips list, for example IntelliBridge Enterprise B.09 to B.15.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2022-21849?

On March 23, 2022, Philips listed CareEvent C.0x, IntelliSpace Perinatal K.x, IntelliVue Guardian Software E.0x, PICiX C.0x, FocalPoint A.0 and A.01, IntelliBridge Enterprise B.09 to B.15, IntelliSpace Portal Server 11.0 and 12.0, Data Warehouse Connect, IntelliSpace Portal Enterprise 12.0 and ISP Enterprise Concerto 12.0 for CVE-2022-21849.

Is there a patch for Windows IKE CVE-2022-21849?

Yes. Microsoft released a patch for CVE-2022-21849 in its January 2022 security update, according to Philips' March 23, 2022 advisory.

← Back to Vulnerabilities