Vulnerability

Philips names ten product lines in Windows Task Scheduler CVE-2024-49039 notice

MedDevice Cyber Staff · Nov 18 · 2 min read · Via Philips product security advisories 2024

Philips published a notice on November 18, 2024 covering CVE-2024-49039, a critical vulnerability in Windows Task Scheduler that Microsoft fixed in its November update. An attacker who exploits it can execute restricted RPC functions and gain escalated privileges.

The list runs to ten product lines: IntelliVue XDS, IntelliVue IGS, IntelliVue Perinatal, ISESG, ST80i, Holter Tower, TraceMasterVue, Universal Data Manager, IntelliSpace Radiology and IntelliSpace PACS. Philips policy allows only Philips authorized changes on these systems, so the patch reaches the device through Philips service.

Privilege escalation needs a foothold first. On a shared clinical workstation that foothold is one phishing click away, so treat the patch as urgent.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Get the Philips validated Windows November 2024 update for each listed product and apply it through Philips service. Until then, restrict interactive logons on the listed workstations and watch for unexpected scheduled tasks.

Pull the product list. Match the listed Philips products against the installed base, including catalogue numbers and versions.
Ask Philips service for the status. Get the validated patch or the interim mitigation for each listed system before applying anything yourself.
Segment the affected hosts. Keep the listed workstations and servers on a clinical VLAN with no direct internet or guest network exposure.
Audit scheduled tasks. Alert on new or changed Task Scheduler entries on the listed hosts.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Off-the-shelf software Hospital network

Holter Tower

Physiological waveform processing

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2024-49039 and which Philips products does it affect?

CVE-2024-49039 is a critical Windows Task Scheduler flaw that lets an attacker execute restricted RPC functions and gain escalated privileges. Philips listed IntelliVue XDS, IntelliVue IGS, IntelliVue Perinatal, ISESG, ST80i, Holter Tower, TraceMasterVue, Universal Data Manager, IntelliSpace Radiology and IntelliSpace PACS on November 18, 2024.

How do hospitals patch Philips systems for CVE-2024-49039?

Philips allows only Philips authorized changes on its systems, so the Windows November 2024 fix for CVE-2024-49039 should come through Philips service for each listed product.

← Back to Vulnerabilities