Vulnerability

Philips names IntelliSpace PACS and UDM in F5 BIG-IP critical CVE review

MedDevice Cyber Staff · Mar 10 · 3 min read · Via Philips product security advisories, 2021 archive

Philips posted an advisory on March 10, 2021, naming four imaging and data products that use F5 technology after F5 disclosed CVE-2021-22986, CVE-2021-22987, CVE-2021-22991 and CVE-2021-22992. Listed products are the Clinical Collaboration Platform (formerly called Vue PACS), IntelliSpace PACS versions 3.6, 4.1, 4.4, 4.4.551 and 4.4.553, Universal Data Manager (UDM) versions 1.1, 2.1 and 3.1, and VueBeyond.

Philips described the F5 alert as four critical CVEs plus three related ones, two high and one medium. Its teams were evaluating Philips products and solutions that use F5 for potential impact and validating actions.

When an F5 appliance fronts a PACS, its flaws become the archive's exposure, whoever wrote the PACS code. The owner of the load balancer has to be in the patch conversation from day one.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips was still evaluating impact when it posted the March 10, 2021 notice. Patch the F5 appliances in front of the listed PACS and UDM deployments against CVE-2021-22986, CVE-2021-22987, CVE-2021-22991 and CVE-2021-22992 per F5's guidance, and confirm with Philips that the change is supported for your configuration.

Find the F5 in the path. Identify every BIG-IP appliance that fronts Clinical Collaboration Platform, IntelliSpace PACS, UDM or VueBeyond.
Apply F5's fixes. Update the appliances to F5's fixed releases for the four critical CVEs, coordinating with Philips service.
Restrict management access. Keep BIG-IP management interfaces on an administrative network unreachable from clinical workstations.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Wired network

Clinical Collaboration Platform

Off-the-shelf software

IntelliSpace PACS

Off-the-shelf software

Universal Data Manager

Off-the-shelf software

VueBeyond

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by F5 CVE-2021-22986?

Philips listed Clinical Collaboration Platform (formerly Vue PACS), IntelliSpace PACS 3.6, 4.1, 4.4, 4.4.551 and 4.4.553, Universal Data Manager 1.1, 2.1 and 3.1, and VueBeyond in its March 10, 2021 advisory on F5 CVE-2021-22986, CVE-2021-22987, CVE-2021-22991 and CVE-2021-22992.

Is IntelliSpace PACS vulnerable to the March 2021 F5 BIG-IP flaws?

Philips said on March 10, 2021, that it was evaluating IntelliSpace PACS and other products that use F5 for impact from the critical F5 CVEs, including CVE-2021-22986, and validating actions.

← Back to Vulnerabilities