Vulnerability

Philips lists 15 products on VMware infrastructure under vCenter flaws CVE-2021-21985 and CVE-2021-21986

MedDevice Cyber Staff · May 26 · 3 min read · Via Philips security advisory

Philips issued an advisory on May 26, 2021 on CVE-2021-21985 and CVE-2021-21986, critical and medium rated vulnerabilities in VMware vCenter Server and Cloud Foundation. Per VMware advisory VMSA-2021-0010, the updates address remote code execution and authentication vulnerabilities.

Philips lists CareEvent C.0x, IntelliSpace PACS 4.4, 4.4.551 and 4.4.553, PIC iX B.0x and C.0x, the Clinical Collaboration Platform, IntelliSpace Portal Server and Enterprise, PerformanceBridge Focal Point A.0x, eCareManager 4.2.x to 4.5.x, Pinnacle 18.x, IntelliSite Pathology Solution, IntelliVue Guardian E.0x, RIS, ICCA H.02 and J.01, Multi-patient Bridge 1.0.x and 2.0.x, and UDM 1.1 and 2.1.

Where Philips supplied the VM or vSphere infrastructure, the patch path runs through Philips. Where the hospital owns vCenter, so does the patch.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Patch vCenter Server for CVE-2021-21985 and CVE-2021-21986 per VMSA-2021-0010. Coordinate with Philips where it supplied the infrastructure for the listed products, and keep vCenter off clinical user networks.

Identify who owns vCenter. Determine whether Philips or the hospital supplied the vSphere stack for each listed product.
Apply VMSA-2021-0010 fixes. Update vCenter Server through the owner of that infrastructure.
Restrict the vSphere Client. Block vCenter access from everything except administrative hosts.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

IntelliSpace PACS

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by VMware CVE-2021-21985?

Philips' May 26, 2021 advisory lists 15 products for CVE-2021-21985 and CVE-2021-21986, including IntelliSpace PACS 4.4, PIC iX B.0x and C.0x, Pinnacle 18.x, eCareManager 4.2.x to 4.5.x, IntelliSpace Portal and UDM 1.1 and 2.1.

What is VMSA-2021-0010?

VMSA-2021-0010 is VMware's advisory for CVE-2021-21985 and CVE-2021-21986, critical and medium rated remote code execution and authentication vulnerabilities in vCenter Server and Cloud Foundation, reviewed by Philips on May 26, 2021.

← Back to Vulnerabilities