Vulnerability

Philips lists end of life Vue PACS and IntelliBridge versions under jQuery CVE-2020-11023

MedDevice Cyber Staff · Feb 21 · 3 min read · Via Philips product security advisories 2025

Philips posted a notice on February 21, 2025 on CVE-2020-11023, a critical jQuery vulnerability first disclosed in 2020 and recently added to CISA's Known Exploited Vulnerabilities catalogue.

The listed products are Focal Point v2.1 and prior, Vue PACS 12.2, IntelliBridge Enterprise (IBE 2.0, B.09, B.10, B.12), IntelliVue Guardian Software E.00 and E.01, VitalSky 2.4.0, and Vue Patient Center v1.0.25.0 and Vue RIS Web v2.1.28.0 for the China market only.

Every listed version has reached End of Life and End of Support. The fix is an upgrade, and a five year old library flaw on an unsupported release will not get a patch.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Plan upgrades off the listed end of life versions of Focal Point, Vue PACS, IntelliBridge Enterprise, IntelliVue Guardian Software and VitalSky. No patch is coming for those versions; restrict their web interfaces to clinical users until replaced.

List end of life installs. Find each listed product version still in service.
Budget the upgrade. Work with Philips on a supported release for each product.
Restrict the web front. Limit the web interfaces to clinical networks and named users until the upgrade.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Off-the-shelf software

Contributing

Web interface

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by jQuery CVE-2020-11023?

Philips listed Focal Point v2.1 and prior, Vue PACS 12.2, IntelliBridge Enterprise (IBE 2.0, B.09, B.10, B.12), IntelliVue Guardian Software E.00 and E.01, VitalSky 2.4.0, Vue Patient Center v1.0.25.0 and Vue RIS Web v2.1.28.0 on February 21, 2025.

Is there a patch for CVE-2020-11023 in Philips Vue PACS 12.2?

Philips said on February 21, 2025 that the listed versions, including Vue PACS 12.2, have reached End of Life and End of Support, so the path is an upgrade to a supported release.

Why did Philips publish a jQuery advisory in 2025?

CISA added CVE-2020-11023, first disclosed by jQuery in 2020, to its Known Exploited Vulnerabilities catalogue, and Philips responded on February 21, 2025.

← Back to Vulnerabilities