Vulnerability

Philips lists PIC iX, ICCA and IntelliVue Guardian under the Print Spooler flaw CVE-2021-34481

MedDevice Cyber Staff · Aug 13 · 3 min read · Via Philips security advisory

Philips issued an advisory on August 13, 2021 on CVE-2021-34481, a Windows Print Spooler elevation of privilege vulnerability. It affects computers running the Print Spooler service on Windows client and server versions from Windows 7 up. The advisory also references CVE-2021-34527.

Philips lists CareEvent C.0x, IntelliSpace Critical Care and Anesthesia H.x and J.x, IntelliVue Guardian Software E.0x, Data Warehouse Connect, IntelliSpace Perinatal K.0, IntelliVue XDS M.0 and N.01, eICU eCare Manager and eSearch, IntelliSpace Portal Server, Workstation and Enterprise Concerto 11.0 and 12.0, Multi-Patient Bridge 1.0.0.1, Device Management Dashboard, FocalPoint A.0 and A.01, and PIC iX B.0x and C.0x.

Most clinical servers never print. Turning the spooler off removes the whole bug class.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Microsoft Print Spooler fixes for CVE-2021-34481 to the 15 listed Philips products as Philips authorizes. Where printing is not needed, have the Print Spooler service disabled through authorized service.

Identify affected installs. Match the 15 products and versions to your fleet.
Disable the spooler where unused. Ask Philips service to turn off Print Spooler on servers that do not print.
Apply the validated patch. Install the Microsoft update once Philips clears it for each product.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

PIC iX

Named operating system

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2021-34481?

Philips' August 13, 2021 advisory lists 15 products for CVE-2021-34481, including PIC iX B.0x and C.0x, IntelliSpace Critical Care and Anesthesia H.x and J.x, IntelliVue Guardian Software E.0x, eICU eCare Manager and IntelliSpace Portal 11.0 and 12.0.

Is Philips PIC iX affected by the Windows Print Spooler vulnerability?

Yes. Philips lists PIC iX B.0x and C.0x as affected by the Windows Print Spooler elevation of privilege flaw CVE-2021-34481 in its August 13, 2021 advisory.

← Back to Vulnerabilities