Vulnerability

Philips lists IntelliSpace PACS, UroNav and PICiX under Windows RPC flaws CVE-2023-21708 and CVE-2023-23405

MedDevice Cyber Staff · Mar 22 · 3 min read · Via Philips product security advisories, 2023 archive

Philips posted an advisory on March 22, 2023, for two critical remote code execution vulnerabilities in the Remote Procedure Call Runtime library of Microsoft Windows, CVE-2023-21708 and CVE-2023-23405. Listed products are CareEvent B.x and C.x, IntelliSpace PACS, UroNav 3.0 and 4.1, Capsule Neuron, PICiX (all versions), Data Warehouse Connect and Universal Data Manager.

Successful exploitation could allow a remote, unauthenticated attacker to take control of the system. The notice title gives the first CVE as CVE-2023-2178, while its text names CVE-2023-21708.

Eleven months after CVE-2022-26809, RPC runtime code execution was back on a Philips list with many of the same products, and blocking RPC at the segment boundary pays off again.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's fixes for CVE-2023-21708 and CVE-2023-23405 to the listed Philips products as Philips validates them. Block inbound RPC at the segment boundary for PACS, monitoring and urology hosts in the meantime.

Patch through Philips. Install the Windows RPC fixes on IntelliSpace PACS, UroNav, PICiX and the other listed products once validated.
Block RPC at the edge. Deny inbound TCP 135 and dynamic RPC ports from outside each clinical segment.
Reuse the 2022 playbook. Apply the same controls used for CVE-2022-26809 to these products.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Wired network

CareEvent

Named operating system

IntelliSpace PACS

Named operating system

UroNav

Named operating system

Capsule Neuron

Named operating system

PICiX

Named operating system

Data Warehouse Connect

Named operating system

Universal Data Manager

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2023-21708?

Philips listed CareEvent B.x and C.x, IntelliSpace PACS, UroNav 3.0 and 4.1, Capsule Neuron, PICiX (all versions), Data Warehouse Connect and Universal Data Manager on March 22, 2023, for CVE-2023-21708 and CVE-2023-23405 in the Windows RPC runtime.

How serious are CVE-2023-21708 and CVE-2023-23405?

Philips called both critical remote code execution vulnerabilities and said successful exploitation could allow a remote, unauthenticated attacker to take control of the system, in its March 22, 2023 advisory.

← Back to Vulnerabilities