Vulnerability

Philips lists Vue PACS, IntelliBridge and UDM products under the Log4j flaw CVE-2021-44228

MedDevice Cyber Staff · Dec 13 · 3 min read · Via Philips security advisory

Philips issued an advisory on December 13, 2021 on CVE-2021-44228, the critical remote code execution vulnerability Apache confirmed in its Log4j utility.

Philips lists 29 products and components. They include Vue PACS modules (Vue Motion, MyVue, Vue Explorer, Web System Configuration, Unified Backend, LTSM) at 12.2.5.0 to 12.2.5.300 and 12.2.8.0, IntelliBridge Enterprise B.13 to B.15, Universal Data Manager 1.x, 2.1 to 2.2 and 3.1, Tasy EMR, IntelliSpace Portal v9 and above, IntelliSite Pathology Solution 5.1, XIRIS 8.2 and 8.3, Radiology WorkSpace 4.1 and Performance Bridge.

Log4j sits inside Java services nobody lists as a dependency. The products that took longest to triage were the ones without an SBOM.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Treat the listed Vue PACS, IntelliBridge Enterprise, UDM and other Philips products as exposed to CVE-2021-44228 until Philips confirms the fix. Apply only Philips approved mitigations or updates. Watch outbound traffic from these servers for callback attempts.

Match the 29 entries to your fleet. Check Vue PACS module versions, IBE, UDM and the rest against Philips' list.
Apply Philips approved mitigations. Install the Log4j fix or mitigation Philips specifies for each product.
Block unexpected egress. Deny outbound LDAP and other callback traffic from the affected servers.
Keep an SBOM. Record Log4j and other Java libraries per product so the next triage is a lookup.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Patient or study database

Tasy EMR

HL7 or FHIR integration

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by Log4j CVE-2021-44228?

Philips' December 13, 2021 advisory lists Vue PACS components at 12.2.5.0 to 12.2.5.300 and 12.2.8.0, IntelliBridge Enterprise B.13 to B.15, Universal Data Manager, Tasy EMR, IntelliSpace Portal v9 and above, IntelliSite Pathology Solution 5.1 and others as affected by CVE-2021-44228.

Is Philips IntelliBridge Enterprise affected by Log4j?

Yes. Philips lists IntelliBridge Enterprise versions B.13 to B.15 as affected by the critical Log4j remote code execution flaw CVE-2021-44228 in its December 13, 2021 advisory.

← Back to Vulnerabilities