Vulnerability

Philips reviews 70 products for Windows RD Gateway and Remote Desktop Client flaws

MedDevice Cyber Staff · Jan 15 · 3 min read · Via Philips security advisory

Philips issued an advisory on January 15, 2020 on CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611, vulnerabilities in the Windows RD Gateway and Windows Remote Desktop Client. Philips said it was evaluating its products and solutions that use Microsoft operating systems.

The product list is long, about 70 entries across imaging, monitoring and informatics: Azurion, Allura, Epiq and Affiniti ultrasound, IQon Spectral CT, Ingenuity and Brilliance CT, MobileDiagnost, PIC iX, IntelliSpace Portal, Xper IM, eICU Care Manager and the Volcano Core Imaging Systems among them.

Remote desktop is how vendors service imaging systems. Every RD path into a modality needs an owner and a patch date.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the January 2020 Microsoft updates for CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611 to the listed Philips systems only as Philips authorizes. Close remote desktop paths that are not required.

Find RD Gateway use. Identify which listed Philips systems run or connect through Windows RD Gateway.
Get Philips clearance. Confirm with Philips service which updates are validated per product.
Close unused remote desktop paths. Disable remote desktop where servicing does not need it.
Log remote sessions. Record every vendor remote session into imaging systems.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Remote access

IntelliSpace Portal

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611?

Philips' January 15, 2020 advisory lists about 70 Windows-based products, including Azurion, Allura, Epiq, Affiniti, IQon Spectral CT, Ingenuity CT, PIC iX and IntelliSpace Portal, for the Windows RD Gateway and Remote Desktop Client flaws CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611.

Did Philips evaluate its imaging systems for the January 2020 RD Gateway vulnerabilities?

Yes. On January 15, 2020 Philips said it was evaluating its products that use Microsoft operating systems, including CT, X-ray, ultrasound and interventional systems, for CVE-2020-0609, CVE-2020-0610 and CVE-2020-0611.

← Back to Vulnerabilities