Vulnerability

Siemens PET/CT and SPECT systems on Windows 7 exposed to remote code execution through third-party services

MedDevice Cyber Staff · Aug 3 · 2 min read · Via CISA ICSMA-17-215-02

CISA published advisory ICSMA-17-215-02 on August 3, 2017, covering four remote code execution vulnerabilities in Siemens molecular imaging products running Windows 7. The listed products are PET/CT Systems, SPECT Systems, SPECT/CT Systems and SPECT Workplaces/Symbia.net, all Windows 7-based versions. Every one of the four CVEs carries a CVSS v3 score of 9.8.

CVE-2015-1635 (CWE-94) lets an unauthenticated remote attacker execute arbitrary code by sending crafted HTTP requests to the Microsoft web server on ports 80/TCP and 443/TCP. The other three sit in the HP Client automation service. CVE-2015-1497 (CWE-94) is reached on port 3465/TCP, CVE-2015-7861 is an improper access control flaw (CWE-284), and CVE-2015-7860 is a memory buffer bounds flaw (CWE-119).

None of these bugs were written by Siemens. They are public 2015 CVEs in Microsoft and HP components that shipped inside the scanners, and the attacker needs no credentials, no user interaction and only network reach. A scanner that sits on the clinical network with those ports open is a Windows server running third-party agents.

The CISA record for this advisory does not list a fixed version. Every third-party service on an imaging system belongs in the SBOM with a patch owner, because a two-year-old CVE in a bundled agent is still a 9.8 on the day it is found in the field.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The CISA record for ICSMA-17-215-02 lists no fixed version, so get the update path for each Windows 7-based PET/CT, SPECT and SPECT/CT system directly from Siemens. Until it is applied, block network access to the Microsoft web server on ports 80/TCP and 443/TCP and to the HP Client automation service on port 3465/TCP. Keep the systems off the internet and behind firewalls.

Get the Siemens update path. Ask Siemens service for the fix status of each affected PET/CT, SPECT, SPECT/CT and Symbia.net installation.
Close the exposed ports. Restrict ports 80/TCP, 443/TCP and 3465/TCP to the hosts that need them, at the firewall in front of the imaging network.
Inventory bundled third-party services. List every Microsoft and HP component on the systems with its version so new CVEs can be matched against it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software Named operating system

Contributing

Wired network Hospital network

PET/CT Systems

PID-23 PID-311 PID-41 Named operating system Off-the-shelf software

SPECT Systems

PID-23 Named operating system

SPECT/CT Systems

PID-23 Named operating system

SPECT Workplaces/Symbia.net

PID-23 Named operating system

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Siemens molecular imaging systems are affected by CVE-2015-1635?

CISA advisory ICSMA-17-215-02, published August 3, 2017, lists Windows 7-based Siemens PET/CT Systems, SPECT Systems, SPECT/CT Systems and SPECT Workplaces/Symbia.net. CVE-2015-1635 (CVSS 9.8) lets an unauthenticated remote attacker run code through crafted HTTP requests to the Microsoft web server on ports 80/TCP and 443/TCP.

What is the HP Client automation service flaw in Siemens PET/CT systems?

CISA advisory ICSMA-17-215-02 lists CVE-2015-1497, CVE-2015-7861 and CVE-2015-7860, each CVSS 9.8, in the HP Client automation service on Windows 7-based Siemens PET/CT Systems. An unauthenticated remote attacker could execute arbitrary code with a crafted request, including on port 3465/TCP.

Is there a patch for the Siemens molecular imaging vulnerabilities in ICSMA-17-215-02?

The CISA record for ICSMA-17-215-02 does not list a fixed version for the Windows 7-based Siemens PET/CT, SPECT and SPECT/CT systems. Operators should get the update path from Siemens and restrict network access to ports 80, 443 and 3465 in the meantime.

← Back to Vulnerabilities