LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips lists Corsium and IntelliSpace PACS in Windows downgrade attack notice

MedDevice Cyber Staff · Sep 20 · 2 min read · Via Philips product security advisories 2024

On September 20, 2024, Philips listed Corsium, ECI Event and Device Readiness and IntelliSpace PACS as affected by CVE-2024-38202 and CVE-2024-21302. Philips calls the pair critical. Both could be exploited in downgrade attacks that unpatch a fully updated Windows operating system.

In a downgrade attack the threat actor forces an up-to-date device to roll back to older software versions, which brings previously mitigated vulnerabilities back. Patch status on the dashboard stops being proof of anything.

For regulated systems that already patch slowly, a silent rollback is the worst case. Verify file versions on the host, and do not rely on the update history alone.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Microsoft mitigations for CVE-2024-38202 and CVE-2024-21302 through Philips service on Corsium, ECI Event and Device Readiness and IntelliSpace PACS. Check actual component versions on each host, since a downgraded system can still report as patched.

Confirm the listed products. Find every Corsium, ECI Event and Device Readiness and IntelliSpace PACS host in the fleet.
Apply the validated mitigation. Get the Philips approved Microsoft guidance for both CVEs and schedule it through Philips service.
Verify versions on disk. Compare installed component versions against the expected baseline instead of trusting update history.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system Field-updatable firmware

Contributing

Off-the-shelf software

Fix the class in your product

The updater does not verify who it talks to or what it installs. As the maker, verify the server certificate and a cryptographic signature on the payload against a device-provisioned key before anything is written. Transport and payload signing are separate controls, and you need both.

Sign the payload. Verify a signature against a key provisioned on the device; refuse unsigned or tampered images.
Verify the server. Validate the full TLS chain and reject a mismatch rather than proceeding.
Block rollback. Refuse downgraded images so an attacker cannot force a known-vulnerable version.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2024-38202 and CVE-2024-21302?

Philips listed Corsium, ECI Event and Device Readiness and IntelliSpace PACS on September 20, 2024 as affected by CVE-2024-38202 and CVE-2024-21302, two critical Windows downgrade attack vulnerabilities.

What is a Windows downgrade attack?

In the downgrade attacks tied to CVE-2024-38202 and CVE-2024-21302, an attacker forces an up-to-date Windows device to roll back to older software versions, reintroducing vulnerabilities that had been fixed.

← Back to Vulnerabilities