Vulnerability

Philips lists 54 products under PrintNightmare, the Windows Print Spooler RCE CVE-2021-34527

MedDevice Cyber Staff · Jul 2 · 3 min read · Via Philips security advisory

Philips issued an advisory on July 2, 2021 on CVE-2021-34527, the Windows Print Spooler remote code execution vulnerability publicly reported as PrintNightmare. CVE-2021-1675 is also referenced.

The list runs to 54 entries. It includes PIC iX B.0x and C.0x, Pinnacle 18.x, IntelliSpace Critical Care and Anesthesia, IntelliSpace Cardiovascular, the IntelliSpace ECG Management System, SPhAERA 3.x to 5.x, UroNav 1.x, 2.x and 3, Xper IM 1.5 and 2.x to 5.x, Xcelera 4.1, IntraSight, SyncVision and the Volcano ComboMap, Core and Core Mobile imaging systems.

PrintNightmare is reachable over the network on any Windows host running the spooler, which on a clinical server is usually by default. Disable it where nothing prints.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's PrintNightmare fixes to the listed Philips products as Philips authorizes, and disable the Print Spooler where printing is not required. Contact Philips service for per-product guidance.

Match the 54 entries to your fleet. Identify installs and versions of each listed product.
Turn off the spooler where unused. Have Philips service disable Print Spooler on systems that do not print.
Apply the validated patch. Install Microsoft's fix for CVE-2021-34527 once Philips clears it.
Watch for new drivers. Alert on unexpected printer driver installs on clinical servers.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

PIC iX

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by PrintNightmare CVE-2021-34527?

Philips' July 2, 2021 advisory lists 54 product entries for CVE-2021-34527, including PIC iX B.0x and C.0x, Pinnacle 18.x, IntelliSpace Critical Care and Anesthesia, Xper IM, Xcelera 4.1, UroNav and the Volcano Core imaging systems.

Are Philips Volcano imaging systems affected by PrintNightmare?

Yes. Philips lists the Volcano ComboMap System, Volcano Core Imaging System and Volcano Core Mobile Imaging System under CVE-2021-34527 in its July 2, 2021 advisory.

← Back to Vulnerabilities