Vulnerability

Siemens PET/CT and SPECT systems on Windows XP exposed to unauthenticated remote code execution

MedDevice Cyber Staff · Aug 3 · 3 min read · Via CISA ICSMA-17-215-01

CISA published advisory ICSMA-17-215-01 on August 3, 2017, covering Siemens molecular imaging products built on Windows XP. The affected lines are the PET/CT Systems, SPECT Systems, SPECT/CT Systems and SPECT Workplaces/Symbia.net, all versions of the Windows XP-based builds.

Two CVEs carry the advisory, and both score 9.8 under CVSS v3. CVE-2008-4250 (CWE-94) lets an unauthenticated remote attacker execute arbitrary code through a crafted remote procedure call request to the Windows server service. CVE-2017-7269 (CWE-119) is a buffer overflow in the WebDAV service: one crafted HTTP request runs code with the permissions of the web server.

Neither flaw is in Siemens code. Both live in the operating system and its bundled web stack, and the advisory record lists them against the SPECT Workplaces/Symbia.net product. The vectors need no credentials and no user interaction, which is the profile worm-style malware goes looking for on flat hospital networks.

CVE-2008-4250 was assigned in 2008, nine years before this advisory. A scanner running in an imaging suite in 2017 that still answered that RPC call tells you how long a medical workstation can sit on an unchanged operating system image.

The CISA record notes that Siemens issued further recommendations to users but does not reproduce a product update in the CSAF data. Any imaging system still on Windows XP belongs on its own segment, with RPC and WebDAV unreachable from anywhere it does not need them.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Treat every Windows XP-based Siemens PET/CT, SPECT, SPECT/CT and Symbia.net workstation as exposed to CVE-2008-4250 and CVE-2017-7269 until Siemens confirms otherwise. Contact Siemens for the recommendations it issued with ICSMA-17-215-01. Until then, isolate the systems and block RPC and WebDAV traffic from the wider network.

Inventory Windows XP imaging systems. Find every PET/CT, SPECT, SPECT/CT and Symbia.net workstation still on the Windows XP build and record where it sits on the network.
Get the Siemens guidance. Ask Siemens service for the recommendations tied to ICSMA-17-215-01 before changing anything on a validated system.
Block RPC and WebDAV. Firewall the server service and the WebDAV service so only the hosts the workflow needs can reach them.
Plan the operating system exit. Put a migration off Windows XP on the capital plan, since the flaws sit in the operating system itself.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system Wired network

Contributing

Off-the-shelf software Web interface Hospital network

SPECT Workplaces/Symbia.net

PID-311 PID-41 Named operating system Web interface

PET/CT Systems, SPECT Systems, SPECT/CT Systems

Named operating system

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Siemens imaging systems are affected by CVE-2008-4250 and CVE-2017-7269?

CISA advisory ICSMA-17-215-01, published August 3, 2017, lists all versions of the Windows XP-based Siemens PET/CT Systems, SPECT Systems, SPECT/CT Systems and SPECT Workplaces/Symbia.net. Both CVEs carry a CVSS v3 score of 9.8.

What does CVE-2017-7269 allow on Siemens SPECT Workplaces/Symbia.net?

Per CISA advisory ICSMA-17-215-01, CVE-2017-7269 lets an unauthenticated remote attacker execute arbitrary code with the permissions of the web server by sending a crafted HTTP request to the WebDAV service on the Windows XP-based Siemens SPECT Workplaces/Symbia.net.

← Back to Vulnerabilities