Vulnerability

Siemens Healthineers lists imaging and lab products affected by DejaBlue Remote Desktop flaws

MedDevice Cyber Staff · Sep 10 · 3 min read · Via Siemens Healthineers security disclosure

Siemens Healthineers published advisory SSA-187667 on September 10, 2019, listing products affected by the DejaBlue vulnerabilities in the Microsoft Windows Remote Desktop Service: CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 and CVE-2019-1226. The list spans MAGNETOM Vida, Sola, Lumina, Altea, Amira and Sempra (VA10A, VA10A-SP01, VA11A, VA11B, VA12M), SOMATOM go. scanners (VA10A, VA20A), Iontris (VA11, VA12, VB11), and all versions of syngo.via, syngo.plaza, syngo Imaging, Atellica Data Manager, Aptio and the Medicalis line.

Microsoft had already released updates for the affected Windows versions. The flaws let an unauthenticated remote attacker execute arbitrary code on any system that exposes the Remote Desktop Service to the network.

Siemens Healthineers said it evaluated products from all business lines, and that most are unaffected because they offer no option to activate the Remote Desktop Service or carry other controls. On the listed products, any modality console with Remote Desktop reachable from the hospital network is the exposure to close first.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Identify every product listed in SSA-187667 and apply the Microsoft updates through the route Siemens Healthineers approves for each. Where Remote Desktop is enabled and not needed, turn it off; where it is needed, block it from untrusted networks until the update is in place.

Match the product list. Compare installed MAGNETOM, SOMATOM go., syngo, Atellica, Aptio and Medicalis systems against SSA-187667.
Apply validated updates. Install the Microsoft DejaBlue fixes only through the path Siemens Healthineers specifies for each product.
Block Remote Desktop exposure. Restrict the Remote Desktop Service port to approved management hosts or disable the service where it is not used.
Audit remote access paths. Confirm no vendor or internal remote access route exposes Remote Desktop on modality consoles to wider networks.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Hospital network Remote access

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Chondral Quant	Siemens Healthineers	Names the affected product	No feedback feed from manufacturer

Questions & Answers

Which Siemens Healthineers products are affected by DejaBlue CVE-2019-1181?

Siemens Healthineers advisory SSA-187667 of September 10, 2019 lists MAGNETOM Vida, Sola, Lumina, Altea, Amira and Sempra, SOMATOM go. scanners, Iontris, syngo.via, syngo.plaza, Atellica Data Manager, Aptio and Medicalis products as affected by CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 and CVE-2019-1226.

Why are most Siemens Healthineers products unaffected by DejaBlue?

In SSA-187667, published September 10, 2019, Siemens Healthineers said most of its products do not provide the option to activate the Windows Remote Desktop Service or implement other controls, so the DejaBlue flaws do not apply to them.

What can an attacker do with the DejaBlue Remote Desktop vulnerabilities?

CVE-2019-1181, CVE-2019-1182, CVE-2019-1222 and CVE-2019-1226 let an unauthenticated remote attacker execute arbitrary code on a Windows system that exposes the Remote Desktop Service to the network, per Siemens Healthineers advisory SSA-187667.

← Back to Vulnerabilities