Vulnerability

Siemens Healthineers fixes seven web service flaws in syngo Dynamics before VA40G HF01

MedDevice Cyber Staff · Nov 17 · 3 min read · Via Siemens Healthineers security disclosure

Siemens Healthineers published advisory SHSA-741697 on November 17, 2022, covering seven vulnerabilities in the web services of the syngo Dynamics server before version VA40G HF01: CVE-2022-42732, CVE-2022-42733, CVE-2022-42734, CVE-2022-42891, CVE-2022-42892, CVE-2022-42893 and CVE-2022-42894.

The flaws could allow man-in-the-middle attacks, leak NTLM credentials, and let an attacker read and write data on the local file system. Siemens Healthineers released an update and recommends moving to the latest version.

Leaked NTLM credentials are worth more than the server they came from, because they can be replayed against other Windows hosts in the domain. Patch the server and then check the accounts it uses.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update syngo Dynamics to VA40G HF01 or later, as Siemens Healthineers recommends in SHSA-741697. After patching, review the Windows accounts the server uses, since the flaws could leak NTLM credentials.

Update to VA40G HF01 or later. Install the Siemens Healthineers syngo Dynamics update on every server.
Rotate exposed credentials. Reset passwords for service and user accounts that authenticated to the syngo Dynamics server before patching.
Restrict web service access. Limit which hosts can reach the syngo Dynamics web services.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Hospital network

syngo Dynamics

PID-311

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same FDA device type	No feedback feed from manufacturer
Image Suite	Carestream Health	Same FDA device type	No feedback feed from manufacturer
aPROMISE X	Exini Diagnostics	Same FDA device type	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same FDA device type	No feedback feed from manufacturer
EchoPAC Software Only, EchoPAC Plug-in	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
ViewPoint 6	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same FDA device type	No feedback feed from manufacturer
Image Management V15	Philips	Same FDA device type	No feedback feed from manufacturer
qCT LN Quant	Qure.ai	Same FDA device type	No feedback feed from manufacturer
OptimMRI	Rebrain	Same FDA device type	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

What vulnerabilities affect syngo Dynamics before VA40G HF01?

Siemens Healthineers advisory SHSA-741697 of November 17, 2022 lists seven CVEs in syngo Dynamics web services before VA40G HF01 that could allow man-in-the-middle attacks, NTLM credential leaks and reading or writing the local file system.

How do I fix CVE-2022-42732 in syngo Dynamics?

Siemens Healthineers released an update for syngo Dynamics and recommends updating to the latest version, VA40G HF01 or later, per advisory SHSA-741697 published November 17, 2022.

← Back to Vulnerabilities