Vulnerability

Philips reviews 52 products running Windows 7 and Server 2008 R2 at end of support

MedDevice Cyber Staff · Jan 14 · 3 min read · Via Philips security advisory

Microsoft ended extended support for Windows 7 and Windows Server 2008 R2 on January 14, 2020, and Philips published an advisory the same day. The company said it had been evaluating its products and solutions that use these operating systems.

Philips names 52 products, among them Brilliance and Ingenuity CT, Incisive CT, Vereos, IntelliSpace PACS 4.4, Vue PACS 11.3 and 11.4, PIC iX and PIIC Classic, IntelliSpace Critical Care and Anesthesia, HeartStart Event Review, Sleepware G3, Xcelera 4.1 and Xper IM 1.5 and 2.x.

An imaging system outlives its operating system by a decade. Without a vendor upgrade path, segmentation is the whole defense.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft stopped security updates for Windows 7 and Server 2008 R2 on January 14, 2020. Ask Philips for the OS upgrade path for each listed product. Isolate systems that cannot move.

List systems on the old OS. Match the 52 Philips products against your fleet.
Plan upgrades with Philips. Request the supported operating system upgrade for each product.
Isolate what stays. Put systems that cannot be upgraded on restricted network segments.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

PIC iX

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same named componentWindows Server (2008 R2)	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (2008 R2)	No feedback feed from manufacturer

Questions & Answers

Which Philips products run Windows 7 or Windows Server 2008 R2?

Philips' January 14, 2020 advisory lists 52 products using Windows 7 or Windows Server 2008 R2, including Brilliance and Ingenuity CT, IntelliSpace PACS 4.4, Vue PACS 11.3 and 11.4, PIC iX, PIIC Classic, Xcelera 4.1 and Xper IM.

When did Windows 7 extended support end for Philips medical devices?

Microsoft ended extended support for Windows 7 and Windows Server 2008 R2 on January 14, 2020. Philips published an advisory that day on its affected products.

← Back to Vulnerabilities