Vulnerability

Philips lists MR, SPECT, ultrasound and telemetry products in Urgent/11 VxWorks advisory

MedDevice Cyber Staff · Aug 1 · 3 min read · Via Philips security advisory

Philips published an advisory on August 1, 2019 on Urgent/11, the set of 11 vulnerabilities Armis disclosed in Wind River's VxWorks real-time operating system and its IPnet TCP/IP stack. Philips says the flaws could lead to remote code execution and allow an attacker to take over a whole system without interacting with the user.

The Philips list covers Achieva and Achieva 3.0T (R5.3, R5.4 and higher), Ingenia (R4, R5.3, R5.4 and higher), Multiva and Prodiva (R5.3, R5.4), BrightView SPECT 1.x, BrightView X and XCT 2.x, HDI 3000 and HDI 3500, Zenition, IntelliSpace Breast, the GEOPC component of Allura and Azurion, and the Smart-hopping Access Point Controller for MX40 and telemetry products.

A network stack bug sits below every application control, so authentication on the device does not help. The telemetry access point controller is the entry to watch: it carries patient alarms.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Urgent/11 flaws in the VxWorks IPnet stack can give remote code execution on the listed Philips MR, SPECT, ultrasound, interventional and telemetry products. Apply Philips-validated updates through service and restrict network traffic to these systems to their required peers.

Inventory the listed products. Match each installed system against the Philips Urgent/11 list and release numbers.
Restrict network peers. Allow traffic to these systems only from required consoles, archives and gateways.
Apply Philips updates. Install Philips-authorized fixes for the VxWorks stack as they become available.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Wired network

Contributing

Off-the-shelf software Hospital network

Achieva, Ingenia, Multiva and Prodiva MR

PID-23 PID-41 Named operating system Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by Urgent/11?

Philips listed Achieva, Ingenia, Multiva and Prodiva MR, BrightView SPECT, BrightView X and XCT, HDI 3000 and 3500, Zenition, IntelliSpace Breast, the GEOPC component of Allura and Azurion, and the Smart-hopping Access Point Controller for MX40 and telemetry in its August 1, 2019 Urgent/11 advisory.

What is Urgent/11 in VxWorks?

Urgent/11 is a set of 11 vulnerabilities Armis disclosed in Wind River VxWorks and its IPnet TCP/IP stack that could lead to remote code execution without user interaction, as Philips described on August 1, 2019.

← Back to Vulnerabilities