Vulnerability

Philips lists VitalSky, PICiX and Efficia CMS200 under exploited Windows CLFS flaw CVE-2023-28252

MedDevice Cyber Staff · Apr 17 · 3 min read · Via Philips product security advisories, 2023 archive

Philips posted an advisory on April 17, 2023, for CVE-2023-28252, a Microsoft zero-day in the Windows Common Log File System (CLFS). Listed products include VitalSky, PICiX (all versions), CareEvent, Data Warehouse Connect, Efficia Central CMS200, IntelliSpace Portal, IntelliSpace PACS, ISP Enterprise, Vue PACS with VuePortal and VueCloud, Ambient Experience and Diagnostic Site Server (DSS).

Philips noted the vulnerability was being actively exploited by cybercriminals to escalate privileges and deploy ransomware payloads. It was the second CLFS privilege escalation on a Philips list in six months, after CVE-2022-37969 in October 2022.

Ransomware crews use this bug class to turn a user-level foothold into control of the host. On a central station such as the Efficia CMS200, that host is the screen clinicians watch.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft's April 2023 fix for CVE-2023-28252 to the listed Philips products as Philips validates it, prioritizing monitoring hosts such as PICiX and Efficia Central CMS200. Reduce first-stage footholds by restricting user rights and web and email use on those hosts.

Prioritize monitoring hosts. Patch PICiX, Efficia Central CMS200 and VitalSky first once Philips validates the update.
Patch the rest. Roll the CVE-2023-28252 fix to IntelliSpace PACS, Vue PACS and the remaining listed products.
Cut foothold paths. Remove local admin rights and block web browsing and email on clinical hosts.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

VitalSky

Named operating system

PICiX

Named operating system

CareEvent

Named operating system

Efficia Central CMS200

Named operating system

IntelliSpace Portal

Named operating system

IntelliSpace PACS

Named operating system

Vue PACS

Named operating system

Diagnostic Site Server

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2023-28252?

Philips listed VitalSky, PICiX, CareEvent, Data Warehouse Connect, Efficia Central CMS200, IntelliSpace Portal, IntelliSpace PACS, ISP Enterprise, Vue PACS, Ambient Experience and Diagnostic Site Server on April 17, 2023, for CVE-2023-28252 in Windows CLFS.

Is CVE-2023-28252 being exploited?

Yes. Philips said on April 17, 2023, that CVE-2023-28252 in the Windows Common Log File System was being actively exploited by cybercriminals to escalate privileges and deploy ransomware payloads.

Is Philips Efficia Central CMS200 affected by the CLFS zero-day?

Yes. Philips listed Efficia Central CMS200 in its April 17, 2023 advisory on CVE-2023-28252, the actively exploited Windows CLFS privilege escalation.

← Back to Vulnerabilities