Vulnerability

Philips names PACS and imaging servers in Zerologon CVE-2020-1472 advisory

MedDevice Cyber Staff · Sep 14 · 3 min read · Via Philips security advisory

Philips published an advisory in September 2020 on Zerologon, CVE-2020-1472, the Microsoft Netlogon elevation of privilege flaw. As Microsoft reported, an elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol ( MS-NRPC ).

Philips listed the Clinical Collaboration Platform (registered as Vue PACS), Illumeo 2.0, IntelliSpace ECG Management System B.00, IntelliSpace PACS 4.4 and 5.5x, IntelliSpace Discovery 2.0, IntelliSpace Portal Server 9.0 and 10.0, UDM 1.1 and 2.2, and XIRIS 8.2 and 8.3.

These are server products, several of which run their own domain controllers. Domain takeover from an unauthenticated network position is the worst case, and it hands an attacker every imaging server joined to that domain.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Zerologon (CVE-2020-1472) lets an attacker with network access to a domain controller elevate privilege through Netlogon. Apply the Philips-validated Microsoft update on any listed product that hosts or joins a domain controller, and restrict Netlogon traffic to required hosts.

Find domain controllers. Identify which listed Philips servers act as or depend on a domain controller.
Apply validated patches. Install the Philips-approved Microsoft Netlogon update.
Restrict RPC traffic. Allow Netlogon only from hosts that need domain services.
Watch for resets. Alert on unexpected machine account password changes on domain controllers.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Hospital network User accounts

Clinical Collaboration Platform (Vue PACS)

PID-23 Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by Zerologon CVE-2020-1472?

Philips listed Vue PACS, Illumeo 2.0, IntelliSpace ECG Management System B.00, IntelliSpace PACS 4.4 and 5.5x, IntelliSpace Discovery 2.0, IntelliSpace Portal Server 9.0 and 10.0, UDM 1.1 and 2.2, and XIRIS 8.2 and 8.3 in its September 2020 Zerologon advisory.

What is Zerologon CVE-2020-1472?

CVE-2020-1472, Zerologon, is an elevation of privilege vulnerability in Microsoft Netlogon that exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using MS-NRPC.

← Back to Vulnerabilities