Committed to proactively addressing the security concerns of our customers

To guide our efforts, we have created a global policy to address the evolving nature of security in medical technology, including product feature requirements, security threat assessment and tracking, and compliance with local government standards.

Security Advisory & Archive

Microsoft CyptoAPI Advisory (16 January 2020)

Publication Date: January 16, 2019
Update Date: January 16, 2019

Philips is currently monitoring developments and updates related to the recent Microsoft alert concerning the reported CryptoAPI spoofing vulnerability – CVE-2020-0601.

As part of the company’s product security policy and protocols, Philips’ teams are evaluating Philips’ products and solutions utilizing Microsoft Operating Systems for potential impacts from these reported vulnerabilities and validating actions. Philips is also monitoring for OS updates related to these vulnerabilities and evaluating further actions or updates to potentially affected Philips products.

Microsoft has released patches to help remediate these vulnerabilities. Philips is currently in the process of evaluating these patches. According to Microsoft, successful exploitation of vulnerability allows Elliptic Curve Cryptography (ECC) certificate validation to bypass the trust store, enabling unwanted or malicious software to masquerade as authentically signed by a trusted or trustworthy organization. This could deceive users or thwart malware detection methods such as antivirus. Additionally, a maliciously crafted certificate could be issued for a hostname that did not authorize it, and a browser that relies on Windows CryptoAPI would not issue a warning, allowing an attacker to decrypt, modify, or inject data on user connections without detection.

If a product does require operating system security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise) are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products.

Microsoft Critical Vulnerability Advisory (15 January 2020)

Publication Date: January 15, 2020
Update Date: January 15, 2010

Philips is currently monitoring developments and updates related to the recent Microsoft alert concerning the reported Windows RD Gateway and Windows Remote Desktop Client vulnerabilities – CVE-2020-0609, CVE-2020-0610, and CVE-2020-0611.

Microsoft has released patches to help remediate these vulnerabilities. Philips is currently in the process of evaluating these patches. According to Microsoft, Successful exploitation of this vulnerability could allow an unauthorized user to execute arbitrary code on the target system. An unauthorized user could then install programs; view, change, or delete data; or create new accounts with full user rights.

Microsoft Win7 and WinServer2008 R2 End-of-Support (14 January 2020)

Publication Date: January 14, 2020

Update Date: January 14, 2020

Philips is aware that Microsoft is ending Extended Support for the Windows 7 and Windows Server 2008 R2 operating systems on January 14, 2020.

As part of Philips product lifecycle management processes, product security policy, and associated protocols, and in anticipation of the expiration of Microsoft’s Extended Support period for Windows 7 and Windows Server 2008 R2, Philips has been evaluating Philips products and solutions that utilize these operating systems.

Philips is currently working to provide information regarding expiration of Microsoft extended support for Windows 7 and Windows Server 2008 as related to Philips products and solutions together with guidance to attain any further required product-specific information in support of any Philips products or solutions that use these Microsoft operating systems.

Philips products and solutions must be deployed and operated within Philips-approved product specifications as noted in their Instructions for Use. Also, as required by government regulations in the markets we operate in, all changes of configuration or software to Philips’ products or solutions (including operating system security updates and patches) may be implemented only by following Philips product-specific, verified and validated, authorized, and communicated customer procedures or field actions.

Contract-entitled customers and service representatives may access product-specific service documentation produced by
Philips product teams and made available to Philips product service support and/or service delivery platforms
such as Philips InCenter (https://incenter.medical.philips.com). Entitled customers are encouraged to request Philips InCenter access and reference product-specific information when posted. Customers are also encouraged to contact their local service support team or regional product service support for information specific to their Philips’ products or environments.

Philips is providing the list below in order to assist our customers in identifying Philips’ products and solutions running on Microsoft Windows 7 or Windows Server 2008 R2. However, the list below is not exhaustive for all affected Philips products, and it includes:

products that have reached Philips end-of-life or end-of-support (****),
software-only products that may also be compatible with other OS versions or that may enable customers with options or roadmap plans to upgrade the customer owned OS and/or affected Philips product (*),
products with a currently available upgrade path to a fully supported Philips solution,
products aligned with 2020 roadmap plans to enable an upgrade path to a fully supported Philips solution,
products with other Philips recommended risk mitigation or remediation steps

Access CT 6/16 – 2.x	Brilliance Big Bore / 4.2	Brilliance iCT/4.x, iCT SP/4.x, 64/4.x
CareEvent *	CompuRecord *	Core Imaging S5 3.5, M2 4.2,
Diagnostic Site Server (DSS)	DynaCAD Breast and Prostate	DynaSuite Neuro 3
eCareManager *	eICU *	G3 Alice6 *
HCIS RIS 2010 10.x Clients	HCIS Vue PACS 11.3, Vue PACS 11.4 *	HCIS Vue RIS 11.0.12.x,
HeartStart Configure 3.1 *	HeartStart Data Messenger 4.3.1 *	HeartStart Event Review 3.x, 4.x ,***
HeartStart Event Review Pro 5.0 *	IBE *	IEM v11.0x *
Incisive CT/1.0	Ingenuity CT / 4.x, Core, Core 128	Ingenuity TF/4.0.x
IntelliSpace Critical Care and Anesthesia (ICCA) *	IntelliSpace ECG Management System B.00 (IECG) *	IntelliSpace ECG Management System B.00 (IECG) *
IntelliSpace PACS 4.4	IntelliSpace Perinatal *	IntelliVue Guardian Software *
ISCV 1.x, 2.x, 3.x, 4.x *	ISP Anywhere 1.3	ISP6/7/8
Mobile 3.5	MX 16/2.x	Oncad
PIIC iX, PIIC Classic *	Respironics Actiware *	SensaVue HD and fMRI
Sleepware G3 *	SPhAERA (3.0 to 3.5) ****	ST80i A.02 *
Syncvision 4.2	Tempus ReachBak i2i *	UDM 1.1, 2.1
Vereos/2.0.x	Viewforum for Fixed Systems V6.3V1L9	Viewforum for Mobile Systems V6.3V1L7, V6.3V1L8
Vue RIS 11.0.14.x	Xcelera 4.1 *	XIRIS 8.3
Xper Flex Cardio	Xper IM 1.5, 2.x *

Information available from Philips InCenter, local service support, or regional product service support.

* Software only products with customer owned Operating Systems

**** End of Life (EoL)

If customers still have questions, all customers are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products or solutions.

Philips Veradius Unity, Pulsera, and Endura Dual WAN Router (19 December 2019)

Publication Date: December 19, 2019

Update Date: December 19, 2019

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory regarding specific Philips Veradius Unity (718132) Medical Devices with a Dual WAN Router (with wireless or ViewForum options) shipped between 2016 and August 2018. In addition, Pulsera (718095), and Endura (718075) Medical Devices with a Dual WAN Router (with wireless or ViewForum options) shipped between 26 June 2017 and 07 August 2018.

Philips has become aware that affected routers may have inadequate encryption strength, which may allow an unauthorized user to compromise the router management interface.

Data confidentiality is protected by internal system design preventing exploitation of the Dual WAN router vulnerability. Even if the Dual Wan Router vulnerability is exploited there is no possible access to patient data or interference with usage of the system. Thus, the medical device is safe to use and has no security risk.

Philips has a solution available for customers who have the wireless or ViewForum option in their product to update the configuration of the Dual WAN router.

To contact their local Philips service support team, or regional service support, Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Please see the Philips product security web site for the latest security information for Philips products: https://www.philips.com/productsecurity

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including US DHS CISA, which is issuing an advisory.

Philips IntelliBridge EC40/80 (14 November 2019)

Publication Date: November 14, 2019

Update Date: December 12, 2019

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding the Philips IntelliBridge EC40 and EC80 Hub.

Philips has become aware of a potential issue with inadequate encryption strength associated with the Philips IntelliBridge EC40 and EC80 Hub. Successful exploitation of this issue may allow an unauthorized user access to the hub, and may allow access to execute software, modify system configuration, or view/update files, including unidentifiable patient data. No known public exploits specifically target this vulnerability. This vulnerability is exploitable from an adjacent network.

Philips plans a new release to remediate this issue by the end of Q3 2020. Philips has not received any reports of exploitation of this vulnerability or of incidents from clinical use that we have been able to associate with this issue.

Philips has reported this potential vulnerability and its mitigation to customers and the appropriate government agencies, including CISA, which is issuing an advisory.

Users with questions regarding their specific Philips IntelliBridge EC40/EC80 Hub installation should contact their local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

US DHS CISA (Cybersecurity and Infrastructure Security Agency): https://www.us-cert.gov/ics/advisories/icsma-19-318-01

Philips IntelliVue Perinatal (24 October 2019)

Publication Date: October 24, 2019

Update Date: October 24, 2019

Philips has become aware that for Versions K and prior of the Philips IntelliSpace Perinatal system, a potential vulnerability may allow an unauthorized user access to system resources. This could impact confidentiality and integrity of the system and application. To exploit this issue, an attacker would require physical access to a locked application screen, or a remote desktop session host application.

Philips has not received any reports of exploitation of this vulnerability or of incidents from clinical use that we have been able to associate with this issue. Philips is providing customers with a detailed update to Philips IntelliSpace Perinatal documentation to provide clear guidance on recommended mitigations for this issue. This documentation is available to customers on Philips InCenter. Philips will be further assessing potential mitigations in the next minor product update, which is planned for the end of 2020.

Philips has reported this potential vulnerability and its mitigation to customers and the appropriate government agencies, including CISA, which is issuing an advisory.

Users with questions regarding their specific Philips IntelliSpace Perinatal installation should contact their Customer Success Manager (CSM), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Please see the Philips product security web site for the latest security information for Philips products: https://www.philips.com/productsecurity

Philips IntelliVue Wireless Local Area Network (WLAN) module (12 Sept 2019)

Publication Date: September 12, 2019

Update Date: September 12, 2019

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory regarding Versions A and B of the Philips IntelliVue Wireless Local Area Network (WLAN) module available in specific Philips IntelliVue Patient Monitors.

Philips has become aware that under certain specific conditions, an unauthorized user with a high skill level and access to the device’s local area network, may be able to corrupt the WLAN firmware and impact data flow. Should there be an interruption; an inoperative device alert on the device and on its associated central station would appear.

At this time, Philips has received no reports of patient harm. Philips analysis has shown that it is unlikely that this vulnerability would impact clinical use, due to mitigating controls currently in place. To date, Philips has received no complaints involving clinical use that we have been able to associate with this problem, or evidence of patient identifiers compromised.

To address this issue, Philips recommends customers update to the WLAN Module Version C wireless module in affected IntelliVue Monitors. WLAN Version C with current firmware of B.00.31 is not vulnerable to the described attack. Regarding other versions, WLAN Version A will be addressed via software patch from Philips estimated to be available in Incenter by the end of 2019. The Philips WLAN Version B is obsolete. Wireless network access should be controlled by authentication and authorization (e.g. WPA2), which are supported by Philips. Additional mitigations include implementing a firewall rule on the customer wireless network, and further controls on physical access to the system.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their Philips IntelliVue WLAN Module software are advised by Philips to contact their local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Please see the Philips product security web site for the latest security information for Philips products: https://www.philips.com/productsecurity

Philips Ultrasound HDI 4000 (29 August 2019)

Publication Date: August 29, 2019

Update Date: August 29, 2019

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory regarding the Philips HDI 4000 Ultrasound system. This system was discontinued in 2006, and product support ceased in 2013.

Philips has become aware that if the Philips HDI 4000 Ultrasound system is running on outdated, unsupported operating systems, such as Windows 2000, an unauthorized user may be able to access ultrasound images or compromise image integrity.

Philips has not received any reports of exploitation of these vulnerabilities or of incidents from clinical use that we have been able to associate with this problem. This issue does not affect patient safety, system operations, or availability.

Philips recommends as mitigation that users implement controls to limit access to the network and consider replacing the system with a newer technology and supported operating system.

Philips has reported this potential vulnerability and its mitigation to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific Philips HDI 4000 Ultrasound system installation should contact their Customer Success Manager (CSM), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Please see the Philips product security web site for the latest security information for Philips products: https://www.philips.com/productsecurity

Microsoft Remote Desktop Services Remote Execution Vulnerability –DejaBlue (15 August 2019)

Publication Date: August 15, 2019
Update Date: December 13, 2019

Philips is currently monitoring developments and updates related to the recent Microsoft alert concerning the reported Remote Desktop Services Remote Code Execution vulnerability named DejaBlue (CVE-2019-1181 and CVE-2019-1182).

Microsoft has released patches to help remediate these vulnerabilities. Philips is currently in the process of evaluating these patches. Successful exploitation of this vulnerability could allow an unauthorized user to execute arbitrary code on the target system. An unauthorized user could then install programs; view, change, or delete data; or create new accounts with full user rights.

Begin Update B: December 13, 2019

Affiniti (30,50,70)	IE33	Juno DRF(5.7)
Analytics 1.1	IEM v11.01-v11.04**	MicroDose SI (L50) (9.0 P1,P2,P3)
ClearVue	IntelliSpace Breast (v2.1, 2.2, 3.1, 3.2)	MicroDose SI U (L50 U)(9.0 P1,P2,P3)
CX50/30	IntelliSpace Cardiovascular (ISCV 1.x - 3.x))*	Sparq
DSS	IntelliSpace PACS 4.4	SPhAERA`(3.6 & up)
Efficia Central - SureSigns Monitor / CMS200(C.01)**	IntelliSpace PACS 4.4.55x	UDM(1.1, 2.1)
Envisor	IntelliSpace Portal Server(7,8,9)**	VISIQ
Epiq (5/7)	IntelliSpace Portal Workstation(7,8,9,10)**	Xcelera 4.1
FocalPoint (A.0/A.01)**	ISP Anywhere(1.3)	XIRIS (8.1, 8.3)
IBE (B.02 - B.09),*	ISP VL Caputre 1.1 Visible Light	Xper IM(1.5, 2.x)
IDM	IU22

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

Note:
For customers who utilize the Remote Services Network (RSN, PRS), all Philips RSN systems are fully protected against this vulnerability and customers are advised not to disconnect the PRS as it may impact Philips service teams from providing any required immediate and proactive support such as remote patching.

Philips is continuing to assess the Microsoft patch for Philips’ products and services that use remote desktop services. Philips will use Incenter as the communication mechanism for necessary mitigation or remediation.

End Update B

Urgent/11 VxWorks and TCP/IP IPnet Advisory (1 August 2019)

Publication Date: August 1, 2019
Update Date: December 11, 2019

Security researchers at Armis have disclosed 11 different zero-day vulnerabilities within Wind River’s VxWorks, a real-time operating system used in over 2 billion embedded systems that include medical devices, routers, VOIP phones and mission-critical infrastructure equipment. The collection of vulnerabilities, which Armis refers to as "Urgent/11," could lead to remote code execution and allow an attacker to take over a whole system without interacting with the user. Of the 11 flaws, six are deemed critical. Successful exploitation of this vulnerability could allow an unauthorized user to execute arbitrary code on the target system. An unauthorized user could then install programs; view, change, or delete data; or create new accounts with full user rights.

Philips is currently monitoring developments and updates related to the recent published advisory (ICSA-19-211-01) concerning the reported 11 CVEs as referred to as Urgent/11. In the advisory, there are several versions of VxWorks listed as not vulnerable, which Philips has taken into consideration for product evaluation and analysis.

As part of the company’s product security policy and protocols, Philips’ teams are evaluating Philips’ products and solutions utilizing VxWorks for potential impacts from these reported vulnerabilities and validating actions. Philips is also monitoring for OS updates related to these vulnerabilities and evaluating further actions or updates to potentially affected Philips products. VxWorks has released patches to help remediate these vulnerabilities. Philips is currently in the process of evaluating these patches.

Begin Update E: December 11, 2019

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products vulnerable to Urgent/11. However, the list below is not comprehensive and may be updated as necessary if more products are identified. It does not indicate the patch or device status.

Achieva and Achieva 3.0T (R5.3, R5.4 and higher)***	HDI 3500 ****	Multiva/Prodiva (R5.4)***
BrightView SPECT(1.x)***	HDI 3000 ****	Smart-hopping Access Point Controller (for MX40 and Telemetry products)**
BrightView X(2.x)***	Ingenia (R4, R5.3, R5.4 and higher)***	Zenition**
BrightView XCT(2.x)***	IntelliSpace Breast (v2.1, 2.2, 3.1, 3.2)
GEOPC (Component of Allura & Azurion) ***	Multiva (R5.3, R5.4)***

**Information or patch available in Incenter

*** Vulnerability is TCP/IP related and these are not network connected

**** End of Life (EoL)

End Update E

Begin Update D: September 11, 2019

Achieva and Achieva 3.0T (R5.3, R5.4 and higher)***	GEOPC (Component of Allura & Azurion) ***	HDI 3000 ****
HDI 3500 ****	Ingenia (R4, R5.3, R5.4 and higher)***	Multiva (R5.3, R5.4)***
Smart-hopping Access Point Controller (for MX40 and Telemetry products)**	Multiva/Prodiva (R5.4)***	Zenition**

**Information or patch available in Incenter

*** Vulnerability is TCP/IP related and these are not network connected

**** End of Life (EoL)

End Update D

Begin Update C: August 15, 2019

Achieva and Achieva 3.0T (R5.3, R5.4 and higher)***	GEOPC (Component of Allura & Azurion) ***	HDI 3000 ****
HDI 3500 ****	Ingenia (R4, R5.3, R5.4 and higher)***	Multiva (R5.3, R5.4)***
Smart-hopping Access Point Controller (for MX40 and Telemetry products)	Multiva/Prodiva (R5.4)***	Zenition**

**Information or patch available in Incenter

*** Vulnerability is TCP/IP related and these are not network connected

**** End of Life (EoL)

End Update C

Begin Update B: August 8, 2019

Update B supersedes products listed in Update A as they were determined to be running non-vulnerable versions of VxWorks.

GEOPC (Component of Allura & Azurion) ***	HDI 3000 ****	HDI 3500 ****
Smart-hopping Access Point Controller (for MX40 and Telemetry products)	Zenition**

**Information or patch available in Incenter

*** Vulnerability is TCP/IP related and these are not network connected

**** End of Life (EoL)

End Update B

Begin Update A: August 2, 2019

**Information or patch available in Incenter

End Update A

Philips Holter 2010 Plus (11 July 2019)

Publication Date: July 11, 2019

Update Date: July 11, 2019

Philips has become aware that under certain specific conditions, an unauthorized user with high skill level may potentially be able to access software options not purchased by the customer. The threat if exploited could lead to the enablement of system options not purchased. It does not impact patient safety, patient data integrity or confidentiality or system operations.

Philips recommends users implement role-based access controls to control physical access to the system. Further controls are provided by the multiple components required to exploit the vulnerability.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific Philips Holter 2010 Plus software installation are advised by Philips to contact their Customer Success Manager (CSM), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions.

Microsoft Remote Desktop Services Remote Execution Vulnerability – BlueKeep (15 May 2019)

Publication Date: May 15, 2019

Update Date: December 10, 2019

Begin Update F: December 10, 2019

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products vulnerable to CVE-2019-0708. However, the list below is not comprehensive and may be updated as necessary if more products are identified. It does not indicate the patch or device status.

Analytics 1.1	IntelliSpace Breast (v2.1, 2.2, 3.1, 3.2)	MicroDose SI U L50 U (9.0 P1, P2, P3, P4, P5)**
CompuRecord (F.02, G.00, and G.01)*	Intellispace Cardiovascular (ISCV),***	MR** Intera/Achieva/Ingenia/Multiva/Panorama 1.0T/Prodiva R5.3
Diagnostics Authoring Workspot (DAW)**	IntelliSpace ECG Management System B.00 (IECG), *	Oncad
Diagnostics Site Server (DSS)	IntelliSpace PACS (4.4, 4.4.551, 4.4.553)***	PIIC Classic (L, M, N, N.01)**
DynaCAD Breast and Prostate*	IntelliSpace Perinatal Revision (H, J, K),*	PIIC iX (A.0, B.0, B.02)**
DynaSuite Neuro 3*	IntelliSpace Portal (ISP) Server& Workstation**	SensaVue HD & FMRI
Efficia Central - SureSigns Monitor / CMS200	IntelliVue Guardian Software,*	ST80i A.02,*
eICU,*	Invivo Esys	UDM (v1.1, 2.1)***
Extended Brilliance Workspace (EBW)**	ISEE**	UroNav (1.x/2.x)
Forcare suite*	ISP Anywhere (v1.3)	Xcelera 4.1*
Holter Recorder DigiTrak XT (DTXT) *	ISP VL Caputre 1.1 Visible Light (v1.1)	XIRIS (8.2, 8.3)
IBE (B.02, B.03, B.04, B.05, B.06, B.07, B.08, B.09, B.10)**	Juno DRF (5.0-.6, 5.7)**	Xper IM,*
ICCA (F, G),*	Lung Cancer Screening Solution*
IDM	MicroDose L30 (8.0, 8.1, 8.2 P1, 8.3 P1, 8.4 P1 P2 P3)**
IEM (v11.00, v11.01, v11.02, v11.03, v11.04)**	MicroDose SI L50 (9.0 P1, P2, P3, P4, P5)**

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

***Philips hosting business validated and deployed the patch to the managed infrastructure

****Patch is tested and can be installed via the windows update mechanism

End Update F

Begin Update E: September 11, 2019

Analytics 1.1	IntelliSpace Breast (v2.1, 2.2, 3.1, 3.2)	MicroDose SI L50 (9.0 P1, P2, P3, P4, P5)
CompuRecord (F.02, G.00, and G.01)*	Intellispace Cardiovascular (ISCV)*	MicroDose SI U L50 U (9.0 P1, P2, P3, P4, P5)
Diagnostics Authoring Workspot (DAW)**	IntelliSpace ECG Management System B.00 (IECG), *	MR Intera/Achieva/Ingenia/Multiva/Prodiva R5.3
Diagnostics Site Server (DSS)	IntelliSpace PACS (4.4, 4.4.551, 4.4.553)	PIIC Classic (L, M, N, N.01)**
Efficia Central - SureSigns Monitor / CMS200	IntelliSpace Perinatal Revision (H, J, K),*	PIIC iX (A.0, B.0, B.02)**
eICU,*	IntelliSpace Portal (ISP) Server& Workstation**	ST80i A.02,*
Extended Brilliance Workspace (EBW)**	IntelliVue Guardian Software*	UDM (v1.1, 2.1)
Forcare suite*	ISEE	Xcelera 4.1*
Holter Recorder DigiTrak XT (DTXT) *	ISP Anywhere (v1.3)	XIRIS (8.2, 8.3)
IBE (B.02, B.03, B.04, B.05, B.06, B.07, B.08, B.09, B.10)**	ISP VL Caputre 1.1 Visible Light (v1.1)	Xper IM*
ICCA (F, G)**	Juno DRF (5.0-.6, 5.7)
IEM (v11.00, v11.01, v11.02, v11.03, v11.04)**	MicroDose L30 (8.0, 8.1, 8.2 P1, 8.3 P1, 8.4 P1 P2 P3)

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

End Update E

Begin Update D: August 15, 2019

CompuRecord (F.02, G.00, and G.01)*	IBE (B.02, B.03, B.04, B.05, B.06, B.07, B.08, B.09, B.10)**	IntelliSpace Portal (ISP) Server& Workstation**
Diagnostics Authoring Workspot (DAW)**	ICCA (F, G)**	IntelliVue Guardian Software*
Efficia Central - SureSigns Monitor / CMS200	IEM (v11.00, v11.01, v11.02, v11.03, v11.04)**	MR Intera/Achieva/Ingenia/Multiva/Prodiva R5.3
eICU,*	IntelliSpace Breast	PIIC Classic (L, M, N, N.01) PIIC iX (A.0, B.0, B.02)
Extended Brilliance Workspace (EBW)**	Intellispace Cardiovascular (ISCV)*	ST80i A.02,*
Forcare suite*	IntelliSpace ECG Management System B.00 (IECG), *	Xcelera 4.1*
Holter Recorder DigiTrak XT (DTXT) *	IntelliSpace Perinatal Revision (H, J, K),*	Xper IM*

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

Note:

For customers who utilize the Remote Services Network (RSN, PRS), all Philips RSN systems are fully protected against this vulnerability and customers are advised not to disconnect the PRS as it may impact Philips service teams from providing any required immediate and proactive support such as remote patching.

End Update D

Begin Update C: June 30, 2019

CompuRecord (F.02, G.00, and G.01)*	IBE (B.02, B.03, B.04, B.05, B.06, B.07, B.08, B.09, B.10)**	IntelliSpace Portal (ISP) Server& Workstation**
DAW**	ICCA (F, G)**	IntelliVue Guardian Software*
Efficia Central - SureSigns Monitor / CMS200	IEM (v11.00, v11.01, v11.02, v11.03, v11.04)**	MR Intera/Achieva/Ingenia/Multiva/Prodiva R5.3
eICU*	IntelliSpace Breast	PIIC Classic (L, M, N, N.01)
Extended Brilliance Workspace (EBW)**	Intellispace Cardiovascular (ISCV)*	ST80i A.02
Forcare suite*	IntelliSpace ECG Management System B.00 (IECG)*	Xcelera 4.1*
Holter Recorder DigiTrak XT (DTXT) *	IntelliSpace Perinatal Revision (F, J.x)*	Xper IM*

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

Note:

End Update C

Begin Update B: June 7, 2019

CompuRecord (F.02, G.00, and G.01)*	IBE (B.02, B.03, B.04, B.05, B.06, B.07, B.08, B.09, B.10)**	IntelliSpace Portal (ISP) Server& Workstation**
DAW**	ICCA (F, G)**	IntelliVue Guardian Software*
Efficia Central - SureSigns Monitor / CMS200	IEM (v11.00, v11.01, v11.02, v11.03, v11.04)**	PIIC Classic (L, M, N, N.01)
eICU*	IntelliSpace Breast	ST80i A.02
Extended Brilliance Workspace (EBW)**	Intellispace Cardiovascular (ISCV)*	Xcelera 4.1*
Forcare suite*	IntelliSpace ECG Management System B.00 (IECG)*	Xper IM*
Holter Recorder DigiTrak XT (DTXT) *	IntelliSpace Perinatal Revision (F, J.x)*

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

Note:

End Update B

Begin Update A: May 22, 2019

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products running Windows XP, Windows 7, Windows 2003 and Windows 2008. However, the list below is not comprehensive and may be updated as necessary if more products are identified. It does not indicate the patch or device status.

CompuRecord (F.02, G.00, and G.01)	Efficia Central - SureSigns Monitor / CMS200	eICU
Holter Recorder DigiTrak XT (DTXT)	IBE (B.02, B.03, B.04, B.05, B.06, B.07, B.08, B.09, B.10)	ICCA (F, G)
IEM (v11.00, v11.01, v11.02, v11.03, v11.04)	IntelliSpace ECG Management System B.00 (IECG)	IntelliSpace Perinatal Revision (F, J.x)
IntelliVue Guardian Software	ST80i A.02

Note:

End Update A

Philips is currently monitoring developments and updates related to the recent Microsoft alert concerning the reported Remote Desktop Services Remote Code Execution vulnerability (CVE-2019-0708).

Microsoft has released patches to help remediate these vulnerabilities. Philips is currently in the process of evaluating these patches.

Successful exploitation of this vulnerability could allow an unauthorized user to execute arbitrary code on the target system. An unauthorized user could then install programs; view, change, or delete data; or create new accounts with full user rights.

DICOM Standard Cybersecurity Vulnerability Research (2 May 2019)

Publication Date: May 2, 2019

Update Date: June 6, 2019

Philips is aware of recently published findings by security researchers regarding the potential for cybersecurity vulnerabilities in medical imaging equipment and networks related to the Digital Imaging and Communications in Medicine (DICOM) standard, which is used for the exchange of medical images. The Philips global Product Security team is reviewing the published research for further analysis.

A number of the research study’s proposed defenses for the type of cyber-attack have long been advocated and implemented by Philips across our systems and products, including network and device environment hardening, as well as data encryption, limiting device Internet exposure and identity/password protection. Philips continues to be a strong proponent of device encryption and end-to-end encryption strategies are part of Philips’ design-for-security development and deployment of our products and systems.

At this time, a Philips product security analysis of imaging systems indicates limited exposure to this potential vulnerability, whether via network-based use or physical media. Philips imaging systems typically do not interpret or otherwise interact with the indicated DICOM “preamble” content, which has been identified as a possible vector for malicious code.

To date, the company has not received any reports of exploitation of these vulnerabilities or incidents from clinical use of Philips products that are associated with the type of attack demonstrated in published research. Additionally, Philips is not aware that the company’s devices were part of the research.

Philips welcomes collaboration with the security research community with regard to exploring strategies and methods to identify, address, and disclose known or potential cybersecurity threats to medical devices. Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. We are dedicated to helping our customers maintain the confidentiality, integrity, and availability of personal data, business data and the Philips hardware and software products that create and manage this data.

Philips operates under a global Product Security policy governing design-for-security in product and services creation, as well as risk assessment and incident response activities for vulnerabilities identified in existing products.

In a medical devices industry “first”, Philips has established a Security Center of Excellence (SCoE) to develop products, which are “cyber-resilient”.

We have also taken the lead in creating a Coordinated Vulnerability Disclosure (CVD) Policy, to collaborate with customers, security researchers, regulators and other agencies to help identify, address and disclose potential vulnerabilities in a safe and effective manner.

To fulfill our commitment to security, Philips maintains a global program to:

Develop, deploy, and support advanced security features for our products and services
Manage security events in the field. Philips participates in industry and government collaborations to help ensure product innovations and clinical information is produced and available at the highest level of quality, availability, and confidentiality.

Philips Tasy EMR (30-April-2019)

Publication Date: April 30, 2019

Update Date: November 7, 2019

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory regarding the Philips TASY EMR system Version 3.02.1744 and earlier (possible cross-scripting issue) and the Philips TASY Web Portal Version 3.02 1757 and earlier (possible information exposure issue).

This is an update to the April 2019 Coordinated Vulnerability Disclosure by Philips regarding this software, to add the TASY Web Portal issue.

Philips has become aware that these potential issues may allow an attacker with low skill to compromise patient confidentiality, system integrity, and/or system availability. Some of the affected vulnerabilities could be attacked remotely.

At this time, Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem. Philips analysis has shown that it is unlikely that this vulnerability would impact clinical use, due to mitigating controls currently in place. Philips analysis indicates that there is no expectation of patient hazard due to this issue. To date, Philips has received no complaints involving clinical use that we have been able to associate with this problem.

Philips advises customers to follow manufacturer instructions in the system configuration manual and not provide Internet access to the system without a Virtual Private Network (VPN). Customers are also advised to be on the last three (3) released versions, following the system software release schedule, and also upgrade service packs as soon as possible. Hosted solutions will be patched automatically. Customers running the application on premise are alerted via release notes on changes to the system.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific Philips TASY EMR system are advised by Philips to contact their Customer Success Manager (CSM), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Doomsday Docker (14-February-2019)

Publication Date: February 14, 2019

Update Date: February 14, 2019

Philips is currently monitoring updates related to the recent advisory by National Institute of Standards and Technology (NIST) regarding a flaw in runc, Docker and Kubernetes’ container runtime. (See Advisory: https://nvd.nist.gov/vuln/detail/CVE-2019-5736.) RunC is the underlying container runtime for Docker, Kubernetes, and other container-dependent programs. It is an open-source command-line tool for spawning and running containers.

As part of Philips’ product security policy and protocols, Health Suite Digital Platform (HSDP) is aware of the recently disclosed security issue that affects several open-source container management systems (CVE-2019-5736). HSDP Operations reviewed the security bulletin and determined that the Cloud Foundry and container-host service environments are not vulnerable due to user namespaces being strictly enforced. No action is required by clients to address this security issue. At this time, Philips has not received reports of these vulnerabilities affecting clinical use of company products.

Philips advises customers with product concerns relating to these vulnerabilities should send an email to productsecurity@philips.com. Further information regarding Philips’ recommendations regarding this event may be found at the Philips product security web site: https://www.philips.com/productsecurity

Customers with questions regarding their specific products are advised to contact their local Philips service support team or their regional service support. Philips contact information is available at the following web page: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Philips HealthSuite Health Android App (6-December-2018)

Publication Date: December 5, 2018

Update Date: December 5, 2018

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory concerning an identified inadequate encryption strength vulnerability affecting the Philips HealthSuite Health Android application.

Unless addressed, this issue may allow an attacker with physical access to potentially impact confidentiality and integrity of the product.

At this time, Philips has received no reports of exploitation of this vulnerability or incidents from clinical use that we have been able to associate with this vulnerability, Philips analysis indicates that there is no expectation of patient hazard due to this issue.

This vulnerability will be addressed by a new software release scheduled for Q1 2019.

Philips advises users against jail-breaking or rooting their mobile device. A jail broken or rooted device means one that is modified outside the mobile device or operating system vendor supported or warranted configurations. Such devices have been freed from the limitations imposed on it by mobile service providers and the phone manufacturers without their approval. This may affect the performance of the App, weaken the security of devices and expose users to additional risks.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific Philips HealthSuite Health Android app are advised by Philips to contact their Customer Success Manager (CSM), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Philips iSite and IntelliSpace PACS Vulnerabilities (8-November-2018)

Publication Date: November 8, 2018

Update Date: November 8, 2018

Philips is a committed leader in medical device cybersecurity. Governed by our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

As part of Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of potential system security vulnerabilities, Philips is proactively issuing an advisory concerning potential vulnerabilities that may affect Philips iSite and IntelliSpace PACS (Picture Archiving and Communications Systems).

Philips has confirmed that Philips iSite and IntelliSpace PACS contain security vulnerabilities that under certain specific conditions could impact or potentially compromise patient confidentiality, system integrity, and/or system availability. These vulnerabilities are not exploitable over the Internet.

As an interim mitigation for this potential issue, Philips recommends that users:

• Ensure only customer-authorized personnel can connect to the customer controlled network environment.

• Review Instructions for Use guidelines available with the application interface and follow the security best practices.

Philips can work with customers to provide assistance with resetting system passwords, or customers may request a Compute Environment (CE) release to address this issue.

Philips IntelliSpace PACS runs in a managed service environment which adheres to ICS-CERT recommendations to minimize the risk of exploitation (Virtual Private Network, Firewall isolation from other networks, no internet access). In addition, Philips employs an automated Antivirus solution that continuously monitors and remediates threats across all systems in the managed service environment. Philips has a monthly recurring patch program which all IntelliSpace PACS users are encouraged to participate. Customers who participate in this program receive all Philips approved operating system and application patches in a timely fashion.

Philips will continue to add cybersecurity vulnerability remediation improvements through our Secure Development Lifecycle (SDL) as threats continue.

Philips has reported these potential vulnerabilities and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific IntelliSpace PACS solutions are advised by Philips to contact their Customer Success Manager (CSM), Market Success Leader (MSL), local Philips service support team, or regional service support. Philips contact information is available at the following location: Customer Service Solutions

Philips EncoreAnywhere APAC Vulnerabilities (8-October-2018)

Publication Date: May 17, 2018

Update Date: October 8, 2018

As part of Philips’ Responsible Disclosure Policy for the awareness and remediation of identified product security vulnerabilities, the company is proactively issuing an advisory concerning a potential, low-risk security vulnerability that may affect the EncoreAnywhere hosted web application deployed for use with certain Philips Respironics products and limited to the Asia/Pacific region. This potential issue only affects EncoreAnywhere APAC 2.36.3.3 and earlier software versions.

Philips has confirmed that the potential security vulnerability, if successfully exploited, may result in unencrypted communication and improper disclosure of sensitive data. This vulnerability could be exploited remotely by an unauthorized user. However, an attacker would require a high level of skill in order to successfully exploit this vulnerability. Vulnerability remediation is planned by September 2018 and was completed at that time.

At this time, Philips has received no reports of exploitation of this vulnerability or incidents from clinical use that have been associated with the vulnerability.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including ICS-CERT, which is issuing an advisory.

Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. Philips has taken the lead in creating a Responsible Disclosure Policy, to collaborate with customers, security researchers, regulators and other agencies to help proactively identify, address and disclose potential vulnerabilities in a safe and effective manner.

Customers with questions regarding their specific Philips installations are advised by Philips to contact their local Philips service support team or their regional service support.
Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Philips eAlert Unit Vulnerabilities (30-AUG-2018)

Publication Date: August 30, 2018

Update Date: August 30, 2018

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory concerning potential unencrypted communication vulnerabilities in versions of Philips e-Alert service units up to and including R2.1.

If successfully exploited, this potential vulnerability may allow an attacker within the same subnet to impact or compromise customer contact details, system integrity, and/or system availability. The vulnerabilities may allow attackers of low skill to provide unexpected input into the application, execute arbitrary code, display system information, or potentially cause a system crash. Philips e-Alert is not a medical device, therefore there is no risk to patient safety.

In June 2018, Philips released a new software version to mitigate this potential issue. This update addressed the vulnerability and enhanced the security capabilities of the e-Alert unit.

Philips has reached out to affected users to schedule updates. Philips encourages users to use Philips-validated and authorized changes only for the e-Alert unit supported by Philips ’authorized personnel or under Philips’ explicit published directions for patches, updates, or releases. Philips always requires that the device never be Internet-facing.

Philips has reported these potential vulnerabilities and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific E-Alert solutions are advised by Philips to contact their local Philips service support team or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Philips IntelliVue Information Center (PiiC iX) B.02 (21-August-2018)

Publication Date: August 21, 2018

Update Date: August 21, 2018

As part of Philips’ Coordinated Vulnerability Disclosure Policy and aligned with U.S. FDA Post-Market Guidance requirements for the awareness and remediation of potential system security vulnerabilities, the company proactively issued an advisory concerning potential security vulnerabilities that may affect Philips IntelliVue Information Center (PiiC iX) B.02 system.

Philips has confirmed that for the B.02 version of the system, Simple TCP Services is enabled, which if successfully exploited, may potentially result in a Denial of Service where the Operating System will become unresponsive during a network attack, which will affect the application’s ability to meet the intended use.

This vulnerability is exploitable remotely. However, a high skill level by an attacker is required for successful exploitation. At this time, Philips has received no reports of exploitation of this vulnerability that impacts clinical use that we have been able to associate with this problem.

Philips has identified and put in place mitigations to reduce the risk of exploitation of this vulnerability. In order for users of affected devices to mitigate exposure to these vulnerabilities, Philips recommends following the device’s labeling, including Instructions for Use and Service Guide(s), which provide compensating controls to mitigate these vulnerabilities.

To mitigate these vulnerabilities; Philips recommends users follow the labeling for the medical device (Security for Clinical Networks Guide) which provides physical and logical security instructions. Philips will be providing the remediation in the form of a patch in Q3 2018 for all PIIC iX B.02 customers.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including ICS-CERT, which is issuing an advisory.

Customers with questions regarding their specific Philips IntelliVue Information Center (PiiC iX) installations are advised by Philips to contact their local Philips service support team or their regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Please see the Philips product security web site for the latest security information for Philips products:

https://www.philips.com/productsecurity

Intel L1 Terminal Fault (L1TF) (16-August-2018)

Publication Date: August 16, 2018

Update Date: August 16, 2018

Philips is currently monitoring updates related to the recent advisory by Intel regarding three recently discovered CPU-related vulnerabilities, currently designated “L1 Terminal Fault” or L1TF. Intel has disclosed that the L1 Terminal Fault vulnerabilities affect the company’s processors manufactured from 2009 to 2018. The three L1 terminal fault vulnerabilities are designated as high risk, and if exploited may lead to unauthorized disclosure of information within an L1 data cache.

Intel further reports it has developed firmware and software updates to minimize potential exploitation of these issues. (See Intel Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html)

As part of Philips’ product security policy and protocols, the company’s global product security team is actively evaluating potential impacts on Philips solutions. At this time, Philips has not received reports of these vulnerabilities affecting clinical use of company products.

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Philips PageWriter TC Series (16-August-2018)

Publication Date: August 16, 2018

Update Date: August 16, 2018

As part of Philips’ Coordinated Vulnerability Disclosure Policy and aligned with U.S. FDA Post-Market Guidance requirements for the awareness and remediation of potential system security vulnerabilities, the company proactively issued an advisory concerning potential security vulnerabilities that may affect Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiograph systems.

The identified potential vulnerabilities include:

· a hardcoded superuser password

· lack of user-input “sanitization”

Philips has determined that a user with both physical access to a Philips PageWriter system as well as a superuser password for the device, could access and modify settings on the device as well as reset existing passwords. The user-input sanitization issue could lead to buffer overflow or format string vulnerabilities. A high degree of skill is required to successfully exploit these issues. Exploits that could target some of the vulnerabilities are known to be publicly available.

At this time, Philips has received no reports of patient harm. It is unlikely that these security issues would impact clinical use due to common use and mitigations currently in place. To date, Philips has received no complaints involving clinical use that we have been able to associate with these identified issues.

Philips analysis has shown that it is unlikely that these issues would impact clinical use, due to mitigating controls currently in place. Additionally, the PageWriter TC cardiograph system is not a life support or treatment device. The ECG record taken by PageWriter TC cardiographs must be confirmed by qualified physicians before being used for diagnostic purposes.

To address the identified vulnerabilities, Philips is issuing a release in 2019 that will address the password and input issues. That release will be offered on both Microsoft Windows CE7 and Windows CE5 operating systems in order to support the installed base. Philips has reported these potential vulnerabilities and anticipated resolution to customers and the appropriate government agencies, including the U.S. Department of Homeland Security’s ICS-CERT, which has issued an advisory.

Users with questions regarding their specific PageWriter TC solutions are advised by Philips to contact their Customer Success Manager (CSM), Market Success Leader (MSL), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

https://www.usa.philips.com/healthcare/about/contact

Please see the Philips product security web site for the latest security information for Philips products:

www.philips.com/productsecurity

Philips IntelliSpace Cardiovascular (ISCV) and Xcelera (14-Aug-2018)

Publication Date: August 14, 2018

Update Date: August 14, 2018

As part of Philips’ Coordinated Vulnerability Disclosure Policy and aligned with U.S. FDA Post-Market Guidance requirements for the awareness and remediation of potential system security vulnerabilities, the company will issue an advisory in cooperation with U.S. DHS/ICS-CERT concerning possible issues with the Philips IntelliSpace Cardiovascular (ISCV) and Xcelera.

Philips has confirmed the findings of a customer submitted complaint of vulnerabilities affecting the Philips IntelliSpace Cardiovascular system version 2.3.1. Philips analysis also confirmed that 3.1 and earlier of the Philips IntelliSpace Cardiovascular system and version 4.x and 3.x of Xcelera are affected as well:

In ISCV version 2.x and earlier and Xcelera 4.x and 3.x the servers contain 20 Windows services of which the executables are being present in a folder where authenticated users have write permissions. The services run as a local admin account or local system account, and if a user were to replace one of the executables with a different program, that program too would be executed with local admin or local system permissions.

In ISCV version 3.x and earlier and Xcelera 4.x and 3.x there are 16 Windows services that do not have quotes in the path name. These services are running with local admin rights, and are initiated with a registry key. This path may permit a user to place an executable that provides local admin rights.

Vulnerability:
If a user were to replace one of the executables with a different program, that program too would be executed with local admin or local system permissions.

Impact / Risk:
The issue occurs only if an authenticated user (without admin privileges) is able to access the ISCV/Xcelera servers locally. By default, this is disabled, since only administrators have the ability access to the ISCV/Xcelera servers locally.

Mitigation / Workaround:
Both vulnerabilities can be mitigated by changing Windows settings. Instructions on how to change these settings are provided in attached Service Bulletin: ISCV and Xcelera Windows services vulnerabilities. This Service Bulletin is also available on InCenter.

Remediation (Fix):
Philips will fix this issue in the next software update: IntelliSpace Cardiovascular 3.2.0, to be released in October 2018. This version will be announced and become available to customers via the regular communication and distribution channels.

At this time, Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem, and no public exploits are known to exist that specifically target these vulnerabilities.

Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. Philips has taken the lead in creating a Coordinated Vulnerability Disclosure policy, to collaborate with customers, security researchers, regulators and other agencies to help proactively identify, address and disclose potential vulnerabilities in a safe and effective manner.

Customers with questions regarding their specific Philips IntelliSpace Cardiovascular (ISCV) and Xcelera installations are advised to contact their local Philips service support team or their regional service support.

Philips IntelliVue Patient and Avalon Fetal Monitors (5-June-2018)

Publication Date: June 5, 2018

Update Date: June 5, 2018

As part of Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of potential system security vulnerabilities, the company is proactively issuing an advisory concerning potential security vulnerabilities that may affect the Philips IntelliVue Patient and Avalon Fetal Monitors.

Philips has confirmed three potential security vulnerabilities. The first if successfully exploited may allow an unauthenticated attacker to access and write to memory (“write-what-where”) from an attacker-chosen device address within the same subnet. The second vulnerability if successfully exploited may allow an unauthenticated attacker to read memory from an attacker-chosen device address within the same subnet. The third vulnerability if successfully exploited exposes an “echo” service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the memory stack with no boundary checks, hence potentially resulting in a stack overflow. If exploited, these vulnerabilities may allow an attacker to read/write memory, and/or induce a denial of service through a system restart, thus potentially leading to a delay in diagnosis and treatment of patients.

These vulnerabilities are not exploitable remotely and cannot be exploited without an attacker first attaining local area network (LAN) access to the medical device. Exploiting these vulnerabilities also requires significant technical knowledge and skill in addition to local area network (LAN) access.

At this time, Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem, and no public exploits are know to exist that specifically target these vulnerabilities.

In order for customers of affected devices to mitigate exposure to these vulnerabilities, Philips recommends following the device’s labeling, including Instructions for Use and Service Guide(s), which provide compensating controls to mitigate these vulnerabilities. Philips is working to issue a software update for the Philips IntelliVue Patient and Avalon Fetal Monitors to address these vulnerabilities. For IntelliVue Patient Monitor, the anticipated patch release date is projected to be Q2 2018 for the current release, and Q3 for older software revisions J through L. For Avalon Fetal Monitor, the anticipated patch release date is projected to be Q3 2018 for Revisions G.0 and J.3. The timing and release of the patches are contingent on verification and validation of the patches and any potentially required regulatory approval.

Philips, in collaboration with security researchers from Medigate, has reported these potential vulnerabilities and their resolution to customers and the appropriate government agencies, including U.S. DHS/ICS-CERT, which is issuing an advisory.

Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. Philips has taken the lead in creating a Coordinated Vulnerability Disclosure policy, to collaborate with customers, security researchers, regulators and other agencies to help proactively identify, address and disclose potential vulnerabilities in a safe and effective manner.

Customers with questions regarding their specific Philips IntelliVue Patient or Avalon Fetal Monitor installations are advised by Philips to contact their local Philips service support team or their regional service support.

Philips CT Imaging System Vulnerabilities (1-MAY-2018)

Publication Date: May 1, 2018

Update Date: October 10, 2019

• Brilliance 64 version 2.6.2 and below

• Brilliance iCT versions 4.1.6 and below

• Brillance iCT SP versions 3.2.4 and below

• Brilliance CT Big Bore 2.3.5 and below

• MX8000 Dual EXP Systems (CWE-798 only)

Philips has confirmed that the potential security vulnerability, if successfully exploited, may allow an attacker to gain unauthorized access to elevated privileges and/or restricted system resources and information. This vulnerability is not exploitable remotely and cannot be exploited without user interaction, and an attacker would need local access to the kiosk environment of the medical device to be able to implement the exploit.

At this time, Philips has received no reports of exploitation of this vulnerability or incidents from clinical use that have been associated with the vulnerability.

Philips has identified the following guidance and mitigations:

• Users should operate all Philips deployed and supported CT products within Philips authorized specifications, including Philips approved software, software configuration, system services, and security configuration such as firewall operations.

• Philips also recommends customers implement a comprehensive, multi-layered strategy to protect their systems from internal and external security threats, including restricting physical access of the scanner to only authorized personnel, thus reducing the risk of physical access being compromised by an unauthorized user.

• Philips has also remediated hard-coded credential vulnerabilities for all Brilliance iCT 4.x and above versions. The Philips iCT-iPatient (v4.x) family Instructions for Use (IFU) refers to the ability to manage credentials and is accessible from Philips In.Center at https://incenter.medical.philips.com for entitled users.

• Since the MX8000 Dual EXP has been out of support since 2017, Philips recommends a replacement based on customer need.

Philips has reported this potential vulnerability and mitigations to customers and the appropriate government agencies, including ICS-CERT, which is issuing an advisory update.

Customers with questions regarding their specific Philips CT installations are advised by Philips to contact their local Philips service support team or their regional service support. Philips contact information is available at the following location: https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Orangeworm and Kwampirs Issue (24-APR-2018)

Publication Date: April 24, 2018

Update Date: April 24, 2018

Overview

A known cyber-attacker group known as Orangeworm is reportedly targeting US, Europe and Asia healthcare organizations with malware known as Kwampirs. The group was identified in 2015 when it was reported to have conducted targeted attacks against organizations in related industries, such as healthcare providers, pharmaceutical, IT solutions providers for healthcare and equipment manufacturers. At the time of this advisory, 40 percent of Orangeworm's confirmed target organizations operate within the healthcare sector and 17 percent of the healthcare organizations were located in the US.

Technical details

Once Orangeworm has infiltrated a victim's network, they deploy Trojan.Kwampirs, a backdoor malware program that provides attackers with remote access to a compromised computer. When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle to the decrypted payload in an attempt to evade hash-based detections. To ensure persistence, Kwampirs creates a service with the following configuration to ensure that the main payload is loaded into memory upon system reboot:

The backdoor also collects some rudimentary information about the compromised computer including some basic network adapter information, system version information, and language settings. The Kwampirs backdoor Trojan then attempts to aggressively copy itself across open network shares to infect other computers.

What you can do

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips products are implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions. If a product does require updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Industry best practice for network security and defense (Please ensure these are in accordance with your product documentation):

Employ regular updates to applications and the host operating system to ensure protection against known vulnerabilities.
Implement a least-privileges policy on the Web server to:

o Reduce adversaries’ ability to escalate privileges or pivot laterally to other hosts.

o Control creation and execution of files in particular directories.

If not already present, consider deploying a demilitarized zone (DMZ) between the Web-facing systems and corporate network. Limiting the interaction and logging traffic between the two provides a method to identify possible malicious activity.
Ensure a secure configuration of Web servers. All unnecessary services and ports should be disabled or blocked. All necessary services and ports should be restricted where feasible. This can include whitelisting or blocking external access to administration panels and not using default login credentials.
Utilize a reverse proxy or alternative service to restrict accessible URL paths to known legitimate ones.
Establish, and backup offline, a “known good” version of the relevant server and a regular change-management policy to enable monitoring for alterations to servable content with a file integrity system.
Employ user input validation to restrict local and remote file inclusion vulnerabilities.
Conduct regular system and application vulnerability scans to establish areas of risk. While this method does not protect against zero day attacks, it will highlight possible areas of concern

Customers entitled by service-contract to use Philips InCenter are encouraged to request and attain InCenter access and reference product-specific information posted on Philips InCenter. All customers with and without service contracts are encouraged to contact their local service support team or regional product service support as needed for current information specific to their products or Philips deployed installations as information becomes available.

Customer Service Solutions

Philips iSite and IntelliSpace PACS Vulnerabilities (28-MAR-2018)

Publication Date: March 28, 2018

Update Date: March 28, 2018

As part of Philips’ Responsible Disclosure Policy for the awareness and remediation of potential system security vulnerabilities, Philips is proactively issuing an advisory concerning potential vulnerabilities that may affect Philips iSite and IntelliSpace PACS (Picture Archiving and Communications Systems).

Philips has confirmed that Philips iSite and IntelliSpace PACS contain security vulnerabilities that under certain specific conditions could impact or potentially compromise patient confidentiality, system integrity, and/or system availability. To remediate the risk of these identified vulnerabilities, Philips is offering customers a number of potential options to select, based on their requirements.

Philips’ analysis has shown that these issues, if fully exploited may allow attackers of low skill to provide unexpected input into the application, execute arbitrary code, alter the intended control flow of the system, access sensitive information, or potentially cause a system crash. Philips has identified that some of the affected vulnerabilities could be attacked remotely. Exploits that could target some of the vulnerabilities are known to be publicly available.

In addition, in 2016 Philips announced software updates and has controlling mitigations on the affected PACS systems to further limit the risk and exploitability of these vulnerabilities. The Philips iSite 3.6 platform is currently at its end of life (EoL) and end of service (EoS).

Philips recommends three paths that customers may select depending on their particular situation, which are offered by Philips at no charge for full service delivery model contracts:

The simplest and most straightforward option is to enroll in Philips recurring patching program, this will remediate 86% of all known vulnerabilities.
A more robust option is to enroll in Philips recurring patching program and updating system firmware. This option will remediate 87% of all known vulnerabilities including all known critical vulnerabilities.
The most robust option by Philips is to enroll in the recurring patching program and update system firmware and upgrade to IntelliSpace PACS 4.4.55x with Windows operating system 2012, which addresses product hardening. This option remediates 99.9% of all the known vulnerabilities including all critical vulnerabilities.

Philips will continue to add cybersecurity vulnerability remediation improvements through our Secure Development Lifecycle (SDL) as threats continue.

Philips has reported these potential vulnerabilities and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Customer Service Solutions

Philips Alice 6 System Vulnerabilities (26-MAR-2018)

Publication Date: March 26, 2018

Update Date: March 26, 2018

As part of Philips’ Responsible Disclosure Policy for the awareness and remediation of potential system security vulnerabilities, the company is proactively issuing an advisory concerning a potential, low-risk security vulnerability that may affect the Philips Alice 6 Polysomnography System (PSG).

Philips has identified hard-coded credentials and clear text storage and transmission of patient personal health information vulnerabilities in Philips Alice 6 devices. Philips has updated product documentation and will release a new version that mitigates these vulnerabilities. These vulnerabilities could potentially be exploited remotely.

Successful exploitation may allow an attacker to gain visibility to usernames/passwords and personal data. Insufficient encryption and cryptographic integrity checks can lead to altered, corrupted, or disclosed personal data. Disclosure of personal data can occur by replacing a trusted node with a malicious node.

Philips is scheduled to release a new product version and supporting product documentation in December 2018. For all users of Alice 6 version up through R8.0.2, Philips will make an update available. This update will introduce HTTPS for remote connections and eliminates hardcoded/fixed password vulnerabilities.

Philips will provide users with notification of the availability of the update. Users will be able to apply the update without Philips assistance.

Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. Philips has taken the lead in creating a Responsible Disclosure policy, to collaborate with customers, security researchers, regulators and other agencies to help proactively identify, address and disclose potential vulnerabilities in a safe and effective manner.

Users with questions regarding their specific Alice 6 solutions are advised by Philips to contact their local Philips service support team or regional service support.

Philips IntelliSpace Portal Vulnerabilities (26-FEB-2018) (Updated 18-APR-2018)

Publication Date: February 26, 2018

Update Date: April 18, 2018

As part of Philips’ Responsible Disclosure Policy for the awareness and remediation of a potential system security vulnerability, the company issued a proactive advisory concerning potential issues with Versions 8.0.x and 7.0.x of the Philips IntelliSpace Portal clinical imaging visualization and analysis solution. NOTE: no incidents of security breach have been reported as a result of these potential vulnerabilities.

Upon disclosing the advisory, it was subsequently published by ICS-CERT – Industrial Control Systems Cyber Emergency Response Team (Advisory ICSMA-18-058-02 Release Date: February 27, 2018), consisting of 6 identified potential issues.

Philips is providing you with more detailed information about the nature of the potential issues reported, the assessment of security vulnerabilities related to these issues, and the mitigation plan to address them.

Below are the potential issues, as reported, with a brief explanation about the source of the issue, and mitigation plan:

ICS-CERT DESCRIPTION

REASON/RESPONSE

MITIGATION

INFORMATION EXPOSURE CWE-200

The ISP has multiple information exposure vulnerabilities that could allow an attacker to gain unauthorized access to sensitive information.

Follow Philips recommendations on installing Microsoft security updates.

Verify that MS17-010 - Security Update for Microsoft Windows SMB Server (4013389) is installed on the ISP system

PERMISSIONS, PRIVILEGES, AND ACCESS CONTROLS CWE-264

The ISP has multiple permission, privilege and access control vulnerabilities that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code.

Access permissions and system configuration items should be reconfigured to assure tighter access control

Will be addressed in the next Service Pack*

LEFTOVER DEBUG CODE CWE-489

The ISP has a vulnerability where code debugging methods are enabled, which could allow an attacker to remotely execute arbitrary code during runtime.

IMPROPER INPUT VALIDATION CWE-20

The ISP has multiple input validation vulnerabilities that could allow a remote attacker to execute arbitrary code or cause the application to crash.

UNQUOTED SEARCH PATH OR ELEMENT CWE-428

An unquoted search path or element vulnerability has been identified, which may allow an authorized local user to execute arbitrary code and escalate their level of privileges.

Parts of ISP legacy code is based on previous software security standards. Current software practices will be in line with updated security standards

Will be addressed in the next Service Pack*

CRYPTOGRAPHIC ISSUES CWE-310

The ISP has multiple cryptographic vulnerabilities that could allow an attacker to gain unauthorized access to resources and information

Current ISP versions implement legacy encryption protocols. Next ISP service pack will include updated cryptographic protocols.
Customers shall use purchased or generated cryptographic certificate.

Software-related issues will be addressed in the next Service Pack
Make sure appropriate certificate is purchased or generated, and installed on the ISP system

*Philips is actively developing and planning to issue software updates to mitigate these potential issues:

• ISP 7.0 Corrective Version (Service Pack 4) is planned to be released by end-June, 2018

• ISP 8.0 Corrective Version (Service Pack 3) is planned to be released by end-December, 2018

Due to the nature of these issues, Philips recommends you follow the guidelines provided here:

1. To address INFORMATION EXPOSURE CWE-200 (High Risk) - Verify that MS17-010 - Security Update for Microsoft Windows SMB Server (4013389) is installed on the ISP system.

2. Due to the low probability and severity of compromise (risk assessment) of the other possible issues, Philips’ recommendation is to continue using the system until a corrective version/service pack is provided.

Customers with questions regarding their specific IntelliSpace Portal installations are advised by Philips to contact their local Philips service support team or their regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Philips IntelliSpace Cardiovascular Vulnerabilities (24-JAN-2018)

Publication Date: January 24, 2018

Update Date: January 24, 2018

Philips has confirmed the findings of a customer submitted complaint of a vulnerability affecting versions 2.3.0 and earlier of the Philips IntelliSpace Cardiovascular (ISCV) cardiac image and information management system. If the IntelliSpace Cardiovascular system is used with an Electronic Medical Record (EMR) in Kiosk mode configured with Windows authentication, there is a possibility that the user may not be properly logged out if the browser is not closed at the end of software use. As a result, a subsequent user of the EMR system, who launches ISCV, will be logged in with the credentials of the previous user. This reported vulnerability may allow an attacker to gain unauthorized access to sensitive information stored on the system and modify this information.

Philips advises users to close the browser at the end of each session, rather than only logging out, to mitigate this potential issue, or to change the authentication configuration to use encrypted logon from the EMR. In this configuration, Windows authentication is not used therefore the vulnerability is not applicable.

At this time, Philips has received no reports of exploitation of this vulnerability or incidents from clinical use that have been able to associate with this problem. The 3.1.0 version of the software will remediate the issue.

Customers with questions regarding their specific ISCV or Xcelera installation should contact their local Philips service support team or their regional service support. In alignment with Philips’ Responsible Disclosure Policy and U.S. FDA Post-Market requirements, Philips worked with the customer who submitted the vulnerability observation and appropriate government agencies to draft and distribute a public security advisory concerning this vulnerability.

Meltdown & Spectre Global Security Issue (05-JAN-2018)

Publication Date: January 5, 2018
Update Date: February 28, 2018

Philips is currently monitoring and actively testing updates related to the recently discovered Meltdown and Spectre global security vulnerabilities. As part of the company’s product security policy and protocols, Philips’ global product security team is actively evaluating potential impacts on Philips solutions. At this time, Philips has not received reports of these vulnerabilities affecting clinical use of company products.

Meltdown and Spectre are two techniques researchers have discovered that circumvent protections exposing nearly any data the computer processes, such as passwords, proprietary information, or encrypted communications. These security vulnerabilities have been globally reported as known issues with Intel, AMD and ARM chips and are not linked to specific individual products or implementations. These flaws are forcing a redesign of the kernel software present in Windows, Mac, and Linux operating systems present on machines running Intel, AMD and ARM chips.

Meltdown allows malicious programs to gain access to higher-privileged parts of a computer's memory, while Spectre steals data from the memory of other applications running on a machine. Currently researchers say that Meltdown is limited to Intel chips, and Spectre attacks Intel, AMD, and ARM processors. Threat actors need access to an enterprise network or a network connection to a specific device to exploit the vulnerability. There are no examples of either exploits in the wild or weaponization of an exploit at this time.

Microsoft has released updates to help mitigate these vulnerabilities. A Linux patch is also currently available. Testing and implementation of these patches by third parties including cloud service providers is reportedly currently underway. As part of the company’s product security policy and protocols, Philips’ teams are evaluating Philips products and solutions for potential impacts from these reported vulnerabilities and validating actions. Philips is also monitoring for OS updates related to these vulnerabilities and evaluating for further actions or updates to potentially affected Philips products.

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips products (including operating system security updates and patches) are implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions. If a product does require operating system security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Philips IntelliSpace Cardiovascular and Xcelera Vulnerabilities (13-NOV-2017)

Publication Date: November 13, 2017
Update Date: November 13, 2017

Philips has confirmed testing observations submitted into Philips by a Philips customer that the ISCV application (version 2.2.0.0) contains a security vulnerability that under certain specific conditions may result in the storage of username and password credentials in clear text within one or more unencrypted system log files, configuration files, or backup files. Philips has further identified that certain conditions of the same security vulnerability also affect potentially all product versions of Philips ISCV (2.3.0 and earlier) and Xcelera (R4.1L1 and earlier).

Philips has received no reports of exploitation of these vulnerabilities or incidents from systems in clinical use that we have been able to associate with this problem.

To remediate this vulnerability, Philips initiates a voluntary medical device correction targeted to be issued for all ISCV systems affected by this vulnerability. Philips is producing software updates for all ISCV and latest Xcelera versions, some of which are available upon request at the time of this advisory (ISCV 1.x, 2.2) for install while other versions are in process of development to be completed by end of 2017. As ISCV updates become available, they are being aligned into a proactive field change order (reference FCO83000202) for Philips to communicate and remediate the identified vulnerability conditions for affected customers.

Customers with questions regarding their specific ISCV or Xcelera installation should contact their local Philips service support team or their regional service support.

In alignment with Philips’ Responsible Disclosure Policy and U.S. FDA Post-Market requirements, Philips worked with the customer who submitted the vulnerability observation and appropriate government agencies to draft and distribute a public security advisory concerning these vulnerabilities.

KRACK WPA2 vulnerability for Wi-Fi (31-OCT-2017)

Publication Date: October 31, 2017

Update Date: October 31, 2017

Philips is aware of the identified Key Reinstallation Attacks (KRACK) security vulnerability affecting electronic products that rely on the WPA2 wireless encryption technology, the most current and commonly used standard worldwide.

This security vulnerability has been widely reported as a known issue with the WPA2 WiFi security standard itself, and is not linked to specific individual products or implementations.

At this time, the known effect of the vulnerability in the WPA2 protocol is that it may allow attackers within physical range of vulnerable devices or access points to possibly intercept passwords and other data presumed to be encrypted. The vulnerability at this time cannot be exploited remotely; the attacker must be within a relatively small physical distance, that also depends on the signal strength.

Like most medical device manufacturers, Philips provides products and solutions with wireless functionality, some of which utilize wireless modules that feature the WPA2 security protocol.

Per Philips’ Global Product Security Policy, the company’s worldwide network of product security officers are evaluating the KRACK vulnerability,and conducting analyses on its potential impact on any Philips products. At this time, Philips has not received confirmed reports of securitycompromise of company products in clinical use. However, Philips continues to investigate potential impacts of this vulnerability on products and solutions. Additionally, the company is monitoring advisories and patch releases by OS manufacturers and WiFi vendors, which are being evaluated for potential implementation in applicable Philips solutions.

In the event of confirmation of possibly affected products, Philips will notify customers and provide guidance on addressing the potential issue. Customers with questions regarding this WPA2 vulnerability should contact their local Philips service support team or regional service support.

Philips IntelliVue MX40 WLAN Patient Wearable Monitor Vulnerabilities (11-SEP-2017)

Publication Date: September 11, 2017

Update Date: September 21, 2017

Philips is releasing this advisory, confirming the findings of a customer submitted complaint and vulnerability report that identified two vulnerabilities in Philips’ IntelliVue MX40 Patient Worn Monitor for use with wireless local area networks (WLAN). Philips has produced a software update that fixes one of the identified vulnerabilities (Partial Re-Association to Central Monitor) and provides mitigations for the remaining vulnerability (Wi-Fi Access Point (AP) “Blacklisting”). In March 2017, Philips initiated a voluntary medical device correction on systems affected by this vulnerability. This was reported to appropriate competent authorities. Philips is planning to release an additional software update in 2017 to address the remaining vulnerability.

Philips has received no reports of incidents from clinical use that we have been able to associate with this problem.

Partial Re-Association to Central Monitor [Improper Cleanup on Thrown Exception]:

Under specific 802.11 network conditions, a partial re-association of the MX40 Patient Worn Monitor (WLAN) to a compatible central monitoring system (Information Center”) is possible. In this state, although the Information Center provides a visible and audible “No Data Tele” INOP alert, the MX40 WLAN itself enters telemetry mode, i.e., its screen turns off in one minute and local alarming is disabled.

This potential issue was addressed with an IntelliVue MX40 software update (version B.06.18) issued in March 2017 (reference FCO86201774), which has been verified in mitigating the impact of network conditions on the device, and to ensure correct operation, messaging and alarm functions.

Wi-Fi Access Point (AP) “Blacklisting” [Improper Handling of Exceptional Conditions]:

Several specific 802.11 Wi-Fi network management instructions might not de-authenticate (disconnect) the MX40 from the access point (AP) without also placing the AP on a security AP blacklist to block or prevent further use of the AP without intervention by staff. While AP blacklisting from the MX40 is an intended security feature of MX40 in response to certain Wi-Fi management messages, several Wi-Fi messages have been identified to invoke AP blacklisting when not required and could be invoked either by environmental Wi-Fi network conditions or a crafted script.

This issue is mitigated by MX40 design and software update B.06.18 whereby MX40 switches into local mode with messaging and alarming on the local device and at the Central Station, thus alerting hospital staff when MX40 disconnects from the AP and disassociates from central. While mitigated, Philips recognizes the potential gap and concern and will release an MX40 software update targeted within 2017 to correct the intended alignment between Wi-Fi management messages and security blacklisting of the AP.

To date, the necessary network conditions for both issues (partial re-association, AP blacklisting) have only been found during system testing by a customer and Philips. Nonetheless, if either of the issues occurred while monitoring a patient, it could result to a delay in treatment. Philips therefore recommends customers update to MX40 software version B.06.18.

Under the terms of Philips’ Responsible Disclosure Policy, Philips worked with the customer and global and U.S. government agencies and related organizations to draft and distribute an advisory concerning this potential issue.

Philips DoseWise Portal Vulnerabilities (17-AUG-2017)

Publication Date: August 17, 2017

Update Date: August 17, 2017

Philips has confirmed the findings of a customer submitted complaint and vulnerability report that the Philips DoseWise Portal (DWP) application (version 1.1.7.333 and 2.1.1.3069) contains security vulnerabilities of hard-coded database credentials stored in clear text (unencrypted) within backend system files behind current production security defenses.

Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem.

For an attacker to use or exploit these vulnerabilities to access the underlying DWP database, elevated privileges are first required in order for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DoseWise Portal application which contains patient health information (PHI). Potential impact could include compromise of patient confidentiality, system integrity, and/or system availability.

The Philips DoseWise Portal (DWP) is a radiation dose management solution which simplifies the collection, analysis and interpretation of patient radiation dose metrics and acquisition parameters across x-ray medical imaging devices. DoseWise Portal captures, tracks, alerts and reports on patient radiation dose to support users to perform statistical analysis of imaging equipment radiation output. This to provide quantitative trends and statistics that users may use as input in planning and tracking dose management improvement activities. DWP is a standalone Class A software in accordance with IEC 62304, classified as a low-safety-risk medical device.

Philips is scheduled to release a new product version and supporting product documentation in August 2017.

For all customers of DWP version 2.1.1.3069, Philips will update the DWP installation to version 2.1.2.3118. This update will replace the authentication method and eliminate the hard-code password vulnerabilities from the DWP system.
For all customers of DWP version 1.1.7.333, Philips will reconfigure the DWP installation to change and fully encrypt all stored passwords.
As an interim mitigation, until the update can be applied, Philips recommends that customers:

- Ensure network security best practices are implemented and

- Block Port 1433, except where a separate SQL server is used.

Philips has notified all customers of the identified vulnerabilities and will coordinate with customers to schedule updates. Philips encourages users to only use Philips-validated and authorized changes for the DoseWise Portal system supported by Philips’ authorized personnel or under Philips’ explicit published directions for product patches, updates, or releases.

Customers with questions regarding their specific DoseWise Portal installations should contact their local Philips service support team or their regional service support.

Worldwide Outbreak of Petya Malware (05-JUL-2017)

Publication Date: July 5, 2017
Update Date: July 5, 2017

ADVISORY / GENERAL GUIDANCE

Philips is aware the current malware campaign known as Petya (also known as NotPetya, Petna, EternalPetya, PetyaBlue, PetyaWrap, Petrwrap, SortaPetya, Nyetya or Expetr) was reported June 27th to be spreading and impacting organizations and critical infrastructure around the globe. The malware encrypts (locks) computers and demands a payment in Bitcoins, according to information shared online by affected institutions. Originally reported as ransomware, industry research now indicates the Petya malware to be a data “wiper” in disguise as ransomware – a form of malware that wipes or destroys access to data without the attacker having either intent or control to enable recovery of the locked files. Most of the initial event was reported to primarily impact organizations in Ukraine. However, new malware infections reportedly spread quickly to impact systems and infrastructure from Russia, The Netherlands, France, India, Australia, the U.S., and other countries. Affected organizations include hospitals, shipping ports, power companies, banks, and an extended list of other types of institutions. According to industry researchers, initial attack vectors were delivered via a Ukrainian company’s (M.E.doc) update service for their finance application, which is popular in Ukraine and Russia. Once the initial compromise took hold, the malware exploited other vulnerabilities to spread over vulnerable networks by exploiting a Windows vulnerability (in SMBv1) similar to the WannaCry outbreak in May. Further information on this Windows vulnerability and the Petya outbreak can be found on the Microsoft website at “Update on Petya malware attacks”.

The vulnerability to this ransomware was identified and a patch was released by Microsoft on March 14, 2017 (MS17-010) for Microsoft supported versions of Windows (including WinVista, WinServer 2008, Win7, WinServer 2008 R2, Win 8.1, WinServer 2012, Win10, WinServer 2012 R2, and WinServer 2016). In further response specific to this ransomware outbreak, Microsoft also took extra steps to release updates for versions of Windows not under Microsoft mainstream support (including WinXP, Win8, and WinServer 2003).

Consistent with Philips Product Security Policy, our global network of product security officers and technical support teams are closely monitoring the situation and continue to take appropriate preventative measures. Philips will continue to work with our customer base to address this malware event and drive any product-specific or customer installation-specific preventative measures such as installation of the latest Microsoft Security Patches, Windows vulnerability containment steps, or other Philips-approved countermeasures as required on Philips products.

AFFECTED PRODUCTS

Select Philips products may be affected by the Microsoft vulnerability being exploited by the Petya malware. The potential for exploitability of any such vulnerability depends on the specific configuration and deployment environment of each product as well as adherence to the intended use of the product.

To date, Philips has not received any reports of Philips products or business operations being directly affected by this reported malware.

Preventative measures on Philips products should be implemented in accordance with Philips authorized steps or countermeasures defined and approved by Philips.

Customers entitled by service-contract to use the Philips InCenter Customer Portal are encouraged to request and attain InCenter access and reference product-specific information posted on Philips InCenter.

Philips highly recommends all customers with and without service contracts contact their local service support team or regional product service support to discuss any needed guidance, services, or questions regarding their specific products or installations. Customers who require general information on Philips Product Security may contact Philips Product Security at productsecurity@philips.com.

PRS/RSN Note:

For customers who utilize the Remote Services Network (RSN, PRS), all Philips RSN systems are fully protected against this vulnerability and customers are advised not to disconnect the PRS as it may impact Philips service teams from providing any required immediate and proactive support such as remote patching.

GENERAL GUIDANCE

The items below are offered as general guidance, are for general consideration only, and must be reviewed in alignment with any posted Philips Service Bulletin with Philips service support to ensure all defined testing and verification processes are followed within product specification and regulatory requirements.

Work with Philips services support to identify and review:

Philips products that have been patched to protect against the SMB vulnerability being exploited by the Petya malware.
Philips products that may still be vulnerable to impact from the Petya malware.
For Philips products that are potentially vulnerable to the Petya malware, consider the following options or combination of options (where applicable and in accordance with authorized Philips service):

-Arrange for Philips service teams to apply any available Philips-approved patches or updates to your system per standard procedures.

-Consider implementing anti-virus access protection rules (Example: Per McAfee Guidance https://kc.mcafee.com/corporate/index?page=content&id=KB89540&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US).

-Consider blocking SMB and RDP ports per Microsoft guidance.

-Consider disabling SMBv1 on our devices if authorized by Philips for your product.

Other General Points for Customer Awareness:

Re-imaging an infected machine will likely overwrite/destroy information on that device.
Making payment to ransomware is not a Philips recommendation. Reportedly, ransom payments in response to Petya infections have not resulted in restored access to a Petya infected files or systems. If payment is made in an effort to decrypt the system, then

-Data, if and when available, should be backed up to a safe location with appropriate restoration procedures.

-Reinstall the system applications with at least one of the recommended actions to prevent re-infection to the device.

-Network segmentation will help prevent harm to the device as long as the SMB and RDP are not utilized and blocked.

SUPPORT OF MICROSOFT GENERAL RECOMMENDATIONS

On June 28^th Microsoft posted their “Update on Petya malware attacks” which included Microsoft recommendations for Windows users to consider toward the identification, prevention, and mitigation of the risk of compromise from reported Windows vulnerabilities being exploited by Petya. The advisory included options for users to consider for deployment of Windows security updates and other changes to system configuration as potential countermeasures.

Philips policy, the U.S. FDA post-market guidance, and other regulatory jurisdiction requirements state that all critical vulnerabilities must be assessed and mitigated. In the case of WannaCry and Petya, a number of Philips products are deployed with default security hardening that securely mitigates the risk of WannaCry and Petya vulnerabilities due to firewall configuration, closed ports, anti-virus/whitelisting, or other security features designed into the product architectures. In those specific cases, Philips will not require Windows security patching to mitigate against WannaCry or Petya threats since those products are not assessed to be vulnerable to exploit from WannaCry or Petya when deployed and operated within specification. Likewise, the same product-by-product assessment is made by Philips relative to other countermeasures like network port blocking that may be recommended by Microsoft but might not be applicable to all Philips products or product versions. Philips product teams therefore assess all published Windows critical vulnerabilities on a product-by-product basis routinely and document product vulnerability status into product MDS2 forms and vulnerability tables. If a product does require Microsoft security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Customers entitled by service-contract to use Philips InCenter are encouraged to request and attain InCenter access and reference product-specific information posted on Philips InCenter. All customers with and without service contracts are encouraged to contact their local service support team or regional product service support as needed for current information specific to their products or Philips deployed installations as information becomes available.

Website Advisory on Worldwide Ransomware Outbreak (WannaCry, et. al.)

Publication Date: May 26, 2017

Update Date: May 26, 2017

Worldwide Outbreak of WannaCry Malware (15-MAY-2017)

ADVISORY / GENERAL GUIDANCE

Philips is aware of the current ransomware campaign known as WannaCry (also known as Ransom-WannaCry, WCry, WanaCrypt, and WanaCrypt0r) which has attacked a large number of organizations and over 300,000 victims around the world in approximately 150 countries. The malware encrypts (locks) computers and demands a payment in Bitcoins, according to information shared online by affected institutions. According to Microsoft, ransomware attacks have been observed to use common email phishing tactics with malicious attachments to infect devices. Once launched, the malware can further spread to adjacent systems on a network by exploiting a Windows vulnerability (in SMBv1). Further information on this Windows vulnerability can be found on the Microsoft website at Microsoft (MS) Customer Guidance for WannaCry Attacks.

The vulnerability to this ransomware was identified and a patch was released by Microsoft on March 14, 2017 (MS17-010) for Microsoft supported versions of Windows (including WinVista, WinServer 2008, Win7, WinServer 2008 R2, Win 8.1, WinServer 2012, Win10, WinServer 2012 R2, and WinServer 2016). In further response specific to this ransomware outbreak, Microsoft also has taken extra steps to release updates for versions of Windows not under Microsoft mainstream support (including WinXP, Win8, and WinServer 2003).

Consistent with Philips Product Security Policy, our global network of product security officers and technical support teams are closely monitoring the situation and continue to take appropriate preventative measures. Philips will continue to work with our customer base to address this malware event and drive any product-specific or customer installation-specific preventative measures such as installation of the latest Microsoft Security Patches, Windows vulnerability containment steps, or other Philips-approved countermeasures as required on Philips products.

INTENDED USE ADVISORY

Philips would like to advise our customers that neither use of an email client nor browsing the Internet is part of the intended use of any Philips product covered by this advisory. Philips products that are not listening on SMB ports (137, 138, 139, 445) or RDP port (3389) are not exposed to this Windows vulnerability provided the product is deployed within Philips product specifications and used in accordance with intended use of the product.

AFFECTED PRODUCTS

Select Philips products may be affected by the Microsoft vulnerability being exploited by the WannaCry ransomware. The potential for exploitability of any such vulnerability depends on the specific configuration and deployment environment of each product as well as adherence to the intended use of the product.

Preventative measures on Philips products currently affected by this MS Windows vulnerability (listed in the table below) should be implemented in accordance with Philips authorized steps or countermeasures defined and approved by Philips.

Customers entitled by service-contract to use the Philips InCenter Customer Portal are encouraged to request and attain InCenter access and reference product-specific information posted on Philips InCenter.

Philips highly recommends all customers with and without service contracts contact their local service support team or regional product service support to discuss any needed guidance, services, or questions regarding their specific product installations. Customers who require further general information on Philips Product Security may contact Philips Product Security at productsecurity@philips.com.

Philips Products

ServicesReference

IS PACS (IntelliSpace Picture Archiving and Communication System):

All Philips IS PACS customers are deployed on Philips managed services. Philips has engaged all IS PACS customers in scheduling full remediation of any potential exposures to the Windows vulnerability exploited by WannaCry.

PhilipsManagedServices

ISP IX (IntelliSpace Portal Workstation IX):

Version: 6.0.2

Philips approved patching materials posted to Philips InCenter, May 2017.

ICAP0034

PIIC iX (IntelliVue Information Center):

Version: PIIC iX A/B and PIIC Classic N.01

Service bulletin SB86202583A posted to Philips InCenter, April 2017.

Version: PIIC Classic – L, M and N.0 (Out-of-Service, End-of-Support)

Service bulletin SB86201939A posted to Philips InCenter, November 2013.

SB86202583A

SB86201939A

IEM (IntelliSpace Event Management):

Service bulletin SB86202577Aupdated inPhilips InCenter, April 2017.

SB86202577A

Philips highly recommends all customers with and without service contracts contact their local service support team or regional product service support to discuss any needed guidance, services, or questions regarding their specific product installations. Supporting documentation is posted on the Philips InCenter Customer Portal. Customers who require further general information on Philips Product Security may contact Philips Product Security at productsecurity@philips.com.

GENERAL GUIDANCE

Work with Philips services support to identify and review:

Philips products that have been patched to protect against the vulnerability being exploited by the WannaCry ransomware.
Philips products that may still be vulnerable to impact from the WannaCry ransomware.
For Philips products that are potentially vulnerable to the WannaCry ransomware, consider the following options or combination of options (where applicable and in accordance with authorized Philips service):

-Consider blocking SMB and RDP ports per Microsoft guidance.

-Consider disabling SMBv1 on our devices if unable to patch the systems.

-Arrange for Philips service teams to apply any available Philips-approved patches or updates to your system per standard procedures.

-Consider implementing anti-virus access protection rules (Example: Per McAfee Guidancehttps://kc.mcafee.com/corporate/index?page=content&id=KB89335&elqTrackId=080d6d6426f34a2fb9b7fae0ca16d59a&elq=ab2a4141be0344bb8dfd6f18c91a9f26&elqaid=7257&elqat=1&elqCampaignId=4054).

Other General Points for Customer Awareness:

Re-imaging an infected machine will likely overwrite/destroy information on that device.
Making payment to ransomware is not a Philips recommendation. However, if payment is made to decrypt the system, then

-Data, if and when available, should be backed up to a safe location with appropriate restoration procedures.

-Reinstall the system applications with at least one of the recommended actions to prevent re-infection to the device.

-Network segmentation will help prevent harm to the device as long as the SMB and RDP are not utilized and blocked.

References Resources:

Microsoft (MS) Customer Guidance for WannaCry Attacks
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
US-CERT: Indicators Associated With WannaCry Ransomware
https://www.us-cert.gov/ncas/alerts/TA17-132A)
ENISA – Europian Union Agency for Network and Information Security: WannaCry Ransomware Outburst
https://www.enisa.europa.eu/publications/info-notes/wannacry-ransomware-outburst

Philips is committed to ensuring robust product security resources and support for our healthcare customers, and their patients who rely on them. We continue to engage with the medical device industry, security research community, and government agencies to monitor the situation, respond accordingly, and meet ongoing healthcare cybersecurity challenges.

Philips Xper-IM vulnerability information (14 Jul 2016)

In the second quarter of 2016, Philips was contacted by security researchers regarding potential security vulnerabilities with the Philips Xper-IM Connect system. As part of our Responsible Disclosure policy and processes, Philips has been in collaboration with the security researchers investigating this issue to promptly and transparently address the identified vulnerabilities in the Xper-IM Connect system.

The joint analysis by Philips and the researchers determined that Xper-IM Connect systems running on unsupported Windows XP operating systems and outdated product software were vulnerable to a number of potential exploits, which if implemented, could result in a remote attacker gaining access to an affected system.

The Philips product security team was able to confirm that all of the reported vulnerabilities in the Xper-IM Connect system are remediated by upgrading to the minimum specification of Windows 2008 Server or the recommended specification of Windows 2008 Server R2 and then applying a new product software version (Xper-IM Connect Version 1.5 Service Pack 13). We are providing recommendations and contact information in order to help any affected customers using a potentially affected Xper-IM Connect System address the issue and correct any affected systems as rapidly as possible.

Both Philips and the security researchers contributed to a joint disclosure to the U.S. Department of Homeland Security’s NCCIC/ICS-CERT organization, and was the source for that body’s Medical Device Advisory concerning this issue.

Philips is committed to ensuring the security and integrity of our products. Philips takes this matter very seriously. While any potential or identified security vulnerabilities are a concern, at this time we are not aware of any customers or patients that have been directly affected by this issue.

Shellshock (Unix Bash shell) Vulnerability

Philips Healthcare is aware of the Unix “Shellshock” security vulnerability. The effect of this vulnerability on Philips healthcare products and services is being investigated by the Philips engineering and product security teams. This site will be updated once a solution is available for any affected product(s).

SSLv3 POODLE Vulnerability

Philips Healthcare is aware of the SSLv3 POODLE security vulnerability. The effect of this vulnerability on Philips healthcare products and services is being investigated by the Philips engineering and product security teams. This site will be updated once a solution is available for any affected product(s).

Philips manufactures, and helps customers maintain, highly complex medical devices and systems. Per policy, only Philips-authorized changes are allowed to be made to these systems, either by Philips personnel or under Philips’ explicit published direction.

Heartbleed Vulnerability

Philips Healthcare is aware of the OpenSSL ‘heartbleed’ security vulnerability. The vulnerability (assigned CVE-2014-0160) impacts OpenSSL versions 1.0.1 – 1.0.1f. The effect of this vulnerability on Philips healthcare products and services is being investigated by the Philips engineering and product security teams. Customers will be notified once a solution is available for any affected product(s).

For our Remote Service solution (PRS) we have reviewed all of our customer facing interfaces and VPN connections to our customer facilities, and can confirm that these are not affected by the Heartbleed issue.

Philips Healthcare and Windows XP End of Support

As part of our continued attention to your security needs, Philips Healthcare wishes to bring to your attention that Microsoft has discontinued support for the Microsoft Windows XP Operating System, following
April 8, 2014.

Where feasible, Philips Healthcare has been developing solutions for products running Windows XP to address continuity of protection against known and emerging security threats and vulnerabilities.

To this end, Philips Healthcare will provide product-specific Statements to assist customers. Where applicable, these Product Statements may provide upgrade or field change order information.

Philips Xper-IM Vulnerabilities (21 Feb 2013)

Philips Healthcare is aware that researchers at a recent cyber-security conference in Florida presented on a security vulnerability in a system component of the Philips Xper Information Management System. This has been investigated by the responsible Philips engineering and product security experts and we expect to provide a software update within a short period of time once the software validation has been completed. Affected customers will be notified directly once this software update is available.

A related concern regarding the disclosure during the conference of service passwords used on Xper IM systems is already being addressed by a Philips Field Change Order (FCO 83000171) which is currently being distributed to all affected customers. The information provided by this FCO also contains instructions to mitigate the above network-based heap overflow vulnerability in the interim.

Philips manufactures, sells and helps you maintain highly complex medical devices and systems. Per policy, only Philips authorized changes are allowed to be made to these systems, either by Philips personnel or under Philips explicit published direction.

Please contact your Philips service representative for specific information about potential vulnerabilities and the availability of patches for your equipment configuration.

Security Advisory Archive

Archive of security notices for customer reference

Product Security

Philips Product Security Statement

Resources

Philips Monitoring Systems:

Our approach to protecting patients, medical devices and information

Committed to proactively addressing the security concerns of our customers

Security status

Manufacturer Disclosure Statement for Medical Device Security

Customers must register for access.

Security Advisory & Archive

Begin Update F: December 10, 2019

End Update F

Begin Update E: September 11, 2019

End Update E

Begin Update D: August 15, 2019

End Update D

Begin Update C: June 30, 2019

End Update C

Begin Update B: June 7, 2019

End Update B

Begin Update A: May 22, 2019

End Update A

ICS-CERT DESCRIPTION

REASON/RESPONSE

MITIGATION

Philips Products

ServicesReference

Resources