Vulnerability

Philips Vue PACS suite carries critical flaws in third-party components

MedDevice Cyber Staff · Jul 6 · 4 min read · Via CISA ICSMA-21-187-01

CISA advisory ICSMA-21-187-01, first published July 6, 2021 and later revised as Update B, covers a long list of vulnerabilities in the Philips Vue imaging suite: Vue PACS, Vue MyVue and Vue Speech 12.2.x.x and prior, and Vue Motion 12.2.1.5 and prior. Antonio Kulhanek and Philips are credited.

Four entries carry a CVSS v3 9.8. CVE-2020-1938 is improper input validation. CVE-2018-12326 and CVE-2018-11218 sit in Redis, a third-party component. Others trace to 7-Zip (CVE-2018-10115, CVSS 7.8) and an Oracle Database component (CVE-2012-1708). The rest span weak cryptography, an expired key, cleartext transmission, improper authentication and a VideoStream function that lets authenticated users read files outside the web root (CVE-2021-39369).

The risk evaluation is broad: eavesdropping, viewing or modifying data, system access, code execution and unauthorized software installation.

This is what an SBOM is for. Most of the critical scores belong to software Philips did not write and shipped inside the product, so the fix depends on the integrator re-releasing with newer components.

Philips released 12.2.1.5 for MyVue and Vue Motion in June 2020, 12.2.8.0 for Vue PACS and Vue Speech in May 2021, and a further Speech security fix in November 2021. It also recommends configuring the environment per its Vue PACS 12 Ports, Protocols and Services Guide (D000763414) on InCenter.

A PACS that bundles a database, a cache and an archiver inherits every one of their advisories, and the product owner has to track all of them.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade Vue PACS and Vue Speech to 12.2.8.0, MyVue and Vue Motion to 12.2.1.5, and apply the November 2021 Speech security fix. Configure the environment to the Vue PACS 12 Ports, Protocols and Services Guide on InCenter, and keep the PACS servers off networks where unauthenticated hosts can reach them.

Upgrade each Vue component. Install 12.2.8.0 for Vue PACS and Speech and 12.2.1.5 for MyVue and Vue Motion, through Philips support.
Apply the Speech security fix. Install the November 2021 release for Vue Speech.
Lock down ports and services. Configure the deployment to Philips guide D000763414 and close everything it does not list.
Track bundled components. Keep an inventory of Redis, 7-Zip, Oracle Database and other bundled software in the PACS and watch their advisories.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

DICOM or image parsing Web interface Patient or study database Hospital network

Vue PACS

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips Vue PACS versions fix the vulnerabilities in ICSMA-21-187-01?

Philips released Vue PACS and Vue Speech 12.2.8.0 in May 2021, MyVue and Vue Motion 12.2.1.5 in June 2020, and a Speech security fix in November 2021, according to CISA advisory ICSMA-21-187-01, first published July 6, 2021.

Does Philips Vue PACS use vulnerable Redis components?

Yes. CISA advisory ICSMA-21-187-01 lists CVE-2018-12326 and CVE-2018-11218, both CVSS v3 9.8, within the third-party Redis component of the Philips Vue PACS suite 12.2.x.x and prior.

What is CVE-2021-39369 in Philips Vue?

CVE-2021-39369 is a relative path traversal (CVSS 2.7) in which the VideoStream function lets authenticated users access files stored outside the web root, as listed in CISA advisory ICSMA-21-187-01 for the Philips Vue suite.

← Back to Vulnerabilities