Vulnerability

Philips Interventional Workspot can be shut down remotely through an OS command injection

MedDevice Cyber Staff · Jan 19 · 2 min read · Via CISA ICSMA-21-019-01

CISA published advisory ICSMA-21-019-01 on January 19, 2021, for an OS command injection (CWE-78) in Philips interventional workstations. CVE-2020-27298 has a CVSS v3 base score of 6.5. Affected products are Interventional Workspot releases 1.3.2, 1.4.0, 1.4.1, 1.4.3 and 1.4.5, ViewForum 6.3V1L10, and Coronary Tools, Dynamic Coronary Roadmap and StentBoost Live 1.0.

The practical impact is availability. Someone on the hospital network can remotely shut down or restart the workstation. CISA notes that physicians can still use diagnostic imaging from the X-ray system if that happens, so the procedure itself is not blinded.

Philips released a patch for the installed base and is scheduling service visits to apply it, under field change order 2019-IGTBST-014. As an interim step, users with the expertise are told to change the IPMI password on the workstation interface.

Out-of-band management interfaces on clinical workstations ship with credentials that rarely get changed. Put IPMI on its own network, or turn it off.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Schedule the Philips service visit under FCO 2019-IGTBST-014 to install the CVE-2020-27298 patch on Interventional Workspot, ViewForum and Coronary Tools workstations. Until then, change the IPMI password on each workstation interface. Restrict IPMI access to a management network.

Book FCO 2019-IGTBST-014. Contact Philips service to apply the patch to every affected interventional workstation.
Change the IPMI password. Replace the IPMI password on the workstation interface, as Philips advises.
Segment management ports. Put IPMI interfaces on an isolated management VLAN unreachable from clinical and business networks.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

Contributing

Remote access User accounts

Interventional Workspot

PID-41 PID-3321 Hospital network Remote access

Fix the class in your product

Malformed or excessive input pushes the service over, and on a monitor that means the screen goes dark. As the maker, validate and bound every input at the boundary, handle malformed messages as a defined error path, and watchdog the clinical display so a fault recovers to a safe view.

Validate and bound input. Enforce type, size, and rate limits; null-check before you dereference.
Fail safe. Handle malformed input as a defined error path, never an unchecked dereference.
Watchdog the display. On a monitor, restore the clinical view quickly and safely after a fault.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2020-27298 in Philips Interventional Workspot?

CVE-2020-27298 is an OS command injection (CWE-78, CVSS v3 6.5) in Philips Interventional Workspot 1.3.2 to 1.4.5, ViewForum 6.3V1L10 and Coronary Tools 1.0 that lets someone on the hospital network shut down or restart the workstation. CISA disclosed it in advisory ICSMA-21-019-01 on January 19, 2021.

How is Philips fixing the Interventional Workspot shutdown vulnerability?

Philips released a patch for CVE-2020-27298 and is scheduling service activities under field change order 2019-IGTBST-014, per CISA advisory ICSMA-21-019-01. In the meantime, users with expertise should change the workstation's IPMI password.

← Back to Vulnerabilities