Vulnerability

Philips lists Azurion, EPIQ and Affiniti under Windows IPv6 flaw CVE-2024-38063

MedDevice Cyber Staff · Aug 30 · 3 min read · Via Philips product security advisories 2024

Philips posted a notice on August 30, 2024 on CVE-2024-38063, a critical TCP/IP remote code execution vulnerability in Microsoft Windows. It affects every system running IPv6, which is enabled by default.

The product list is the longest in this batch of notices. It includes Azurion R2 and R3, Allura 8.x, Zenition 10 to 90, Interventional Workspot, Coronary Tools 3.1, EPIQ and Affiniti (V4.0 to 10.0), Sparq, ClearVue, CX50, Compact 5000, Echonav, IntelliSpace Portal v12, IntelliSpace Perinatal, IntelliSpace ECG, IntelliVue XDS, IntelliVue Guardian Software, Holter SW, Corsium and two ECI modules.

The flaw sits in the Windows TCP/IP stack and needs no login, which is why it rates critical. Interventional and ultrasound systems are rarely patched on the Patch Tuesday cadence. Philips policy allows only Philips authorized changes on these systems, so the patch reaches the device through Philips service.

Where IPv6 is not used on the clinical segment, turning it off at the network shrinks the window while the validated patch is scheduled.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Schedule the Philips validated Windows update for CVE-2024-38063 on each listed system through Philips service. Until it lands, block or disable IPv6 on clinical segments that do not use it.

Map the fleet. Match the listed Philips modalities and software versions to installed systems.
Cut IPv6 exposure. Filter IPv6 at the segment boundary where the clinical network does not need it.
Patch through Philips. Request the validated Windows update for each listed product from Philips service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system Wired network

Contributing

Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips systems are affected by CVE-2024-38063?

On August 30, 2024 Philips listed Azurion R2 and R3, Allura 8.x, Zenition, Interventional Workspot, EPIQ, Affiniti, Sparq, ClearVue, CX50, Compact 5000, Echonav, IntelliSpace Portal v12, IntelliSpace Perinatal, IntelliSpace ECG, IntelliVue XDS and other products under CVE-2024-38063, the Windows TCP/IP IPv6 remote code execution flaw.

Does CVE-2024-38063 require IPv6 to be enabled?

Yes. Philips noted on August 30, 2024 that CVE-2024-38063 affects all Windows systems running IPv6, and IPv6 is enabled by default.

How do I patch an Azurion or EPIQ system for CVE-2024-38063?

Philips allows only Philips authorized changes on its systems, so the Windows fix for CVE-2024-38063 on Azurion, EPIQ and the other listed products should come through Philips service.

← Back to Vulnerabilities