Vulnerability

Siemens Healthineers reports syngo deserialization flaw across CT, MRI, PET/CT and mammography systems

MedDevice Cyber Staff · May 31 · 3 min read · Via Siemens Healthineers security disclosure

Siemens Healthineers published advisory SHSA-455016 on May 31, 2022, disclosing CVE-2022-29875, a deserialization vulnerability in syngo that could allow an unauthenticated attacker to perform remote code execution under certain circumstances. Multiple products built on the platform are affected to varying degrees.

The list covers Biograph Horizon PET/CT (VJ30 versions before VJ30C-UD01), MAGNETOM systems on NUMARIS X (VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (VC20 versions before VC20D), NAEOTOM Alpha (VA40 versions before VA40 SP2), and SOMATOM go.All, go.Now, go.Open Pro and go.Sim (versions before VA30 SP5 or VA40 SP2).

Insecure deserialization turns any data the platform accepts into a potential code path. One shared software base means one flaw lands across four modalities at once.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Move affected systems to the versions SHSA-455016 sets as the boundary: VJ30C-UD01 for Biograph Horizon, VC20D for MAMMOMAT Revelation, VA40 SP2 for NAEOTOM Alpha, and VA30 SP5 or VA40 SP2 for SOMATOM go. For MAGNETOM NUMARIS X, apply the guidance Siemens Healthineers gives for each listed version and restrict network access to the scanners.

Map scanners to the advisory. Record model and software version for each CT, MRI, PET/CT and mammography system against SHSA-455016.
Upgrade through vendor service. Schedule the software levels the advisory names with Siemens Healthineers service.
Limit inbound traffic. Allow connections to scanner consoles only from the PACS, worklist and service hosts they need.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Hospital network

Fix the class in your product

The product turns untrusted bytes into objects without constraint. As the maker, stop deserializing untrusted data into arbitrary types: move to a schema-validated format across trust boundaries, and set any framework type filter to its most restrictive value.

Allow-list types. Validate structure and allow-list expected types before constructing anything.
Restrict the framework. On .NET Remoting set TypeFilterLevel to Low, or replace remoting with an authenticated schema-checked API.
Block the endpoint. Firewall the deserialization port so untrusted hosts cannot reach it.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
ARTIS pheno	Siemens Healthineers	Names the affected product	No feedback feed from manufacturer
Chondral Quant	Siemens Healthineers	Names the affected product	No feedback feed from manufacturer

Questions & Answers

What is CVE-2022-29875 in Siemens syngo?

CVE-2022-29875 is a deserialization vulnerability in Siemens Healthineers syngo that could allow an unauthenticated attacker to perform remote code execution under certain circumstances, disclosed in SHSA-455016 on May 31, 2022.

Which SOMATOM go. versions are affected by CVE-2022-29875?

SHSA-455016 of May 31, 2022 lists SOMATOM go.All, go.Now, go.Open Pro and go.Sim versions before VA30 SP5 or VA40 SP2 as affected by CVE-2022-29875.

Are MAGNETOM MRI systems affected by the syngo deserialization flaw?

Yes. Siemens Healthineers advisory SHSA-455016 lists MAGNETOM systems on NUMARIS X versions VA12M, VA12S, VA10B, VA20A, VA30A and VA31A as affected by CVE-2022-29875.

← Back to Vulnerabilities