Publication Date: 2021 February 09 

Update Date:  2021 March 23

 

Philips is currently monitoring developments and updates related to the recent Microsoft alert concerning a set of fixes affecting Windows TCP/IP implementation that includes two Critical Remote Code Execution (RCE) vulnerabilities (CVE-2021-24074, CVE-2021-24094) and an Important Denial of Service (DoS) vulnerability (CVE-2021-24086).

 

The three TCP/IP security vulnerabilities impact computers running Windows client and server versions starting with Windows 7 and higher. According to Microsoft, of the three vulnerabilities, the CVE-2021-24086 flaw is most likely to be exploited for orchestration of denial-of-service attacks that cause a STOP error with a Blue Screen of Death in Windows OS.


The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are less likely to be exploited in the short term. However, researchers at Microsoft believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release. Thus, Microsoft recommends customers move quickly to apply Windows security updates as soon as possible. These vulnerabilities result from a flaw in Microsoft’s implementation of TCP/IP and affect all Windows versions. 

 

Microsoft has released patches to help remediate these vulnerabilities. Philips is currently in the process of evaluating these patches. As part of the company’s product security policy and protocols, Philips’ teams are evaluating Philips’ products and solutions utilizing Microsoft Operating Systems for potential impacts from these reported vulnerabilities and validating actions. Philips is also monitoring for OS updates related to these vulnerabilities and evaluating further actions or updates to potentially affected Philips products. 

 

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips’ products (including operating system security updates and patches) may be implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions.

 

If a product does require operating system security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

 

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise)  are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products.

 

Begin Update C: 2021 March 23

Access CT16 Slice (v2.0.0.31538)
DigitalDiagnost C50, C90 and Opta C50 (v1.x.x)
IntelliSpace Portal Server (V9.0-11.0)**
Access CT6 Slice (v2.0.0.31538)
DR Compact (v3.1)
IntelliSpace Portal Workstation (V9.0-11.0)**
Achieva, Achieva 3.0T and Achieva XR (vR5.3, R5.4 and higher)
DuraDiagnost (v3.0.0-4.0.7)
IntelliVue Guardian Software(vE.0x)*
Affiniti 30/50/70
DuraDiagnost Compact (v2.1.0-2.1.3)
IQon Spectral CT (v4.7.2, 4.7.5, 4.7.7)
Big Bore/Big Bore RT (v4.2, 4.8)
DuraDiagnost F30
Brilliance 64 (v4.1.6, 4.1.7, 4.1.10)
Dream Mapper**
Juno DFR 5.7
Brilliance ICT (v4.1.6, 4.1.7)
Easy Diagnost (v5.1.0-5.1.1)
Microdose S0 (Balder) 11.0 and MicroDose SI & SI U (L50 & L50 U) 9.0 P1, P2, P3, P4, P5
Brilliance ICT SP (v4.1.6)
eICU eCare Manager*
MobileDiagnost M50, Opta and wDR (1.2-2.10)
CareEvent*,**
Emergency Care Informatics
(v2)**
Multi-Patient Bridge (v1.0.0.1)*
Care Orchestrator (v1)
Encore Anywhere (v2.41)**
Multiva and Multiva/Prodiva R5.3 and R5.4 and higher
ClearVue
Epiq 5/7
PIC iX (B.0x, C.0x)*,**
Clinical Collaboration Platform (VuePACS)
FocalPoint A.0/A.01*
Prograde (v1.0.0-1.2)
CombiDiagnost R90 (v1.0.0-1.0.1.1, 1.0.0.2, 1.01, 1.0.1.1)
Graph Mammo
ProxiDiagnost N90
Corsium
Ingenia (vR5.3, R5.4 and higher)
RIS (formally known as Vue) 11.3
CT5000 Ingenuity (v4.1.10)
Ingenuity (v4.0.0-4.1.7)
Sleep Support Portal & PSPNet**
CT 6000 iCT (v4.1.10)
IntelliSpace Breast (v2.1, 2.2, 3.1, and 3.2)
Sparq
CT MX16 EV02 (v2.0)
Intellispace Consultative Critical Care (ICCC) (vB.02)*
SPhAERA (v3.0 and higher)
CX50/30
Intellispace ECG (IECG) (vB.00)*,**
Vereos (v2.0x)
Diagnostics Site Server (DSS)**
IntellisPace Perinatal (ISP) (v. J.x, K.x)*,**
DigitalDiagnost (v3.2.0-4.2)**
Intellispace Critical Care and Anesthesia ICCA (v. H.x, J,x)*,**

*Software only products with customer owned Operating Systems. For products solutions where the server was provided, it is customer responsibility to validate and deploy patches.

**Information or patch available in Incenter.

***Philips hosting business is in the process of validating and deploying the patch to the managed infrastructure.

 

End Update C

 

Begin Update B: 2021 March 17

Access CT16 Slice (v2.0.0.31538)
DigitalDiagnost C50, C90 and Opta C50 (v1.x.x)
IntellisPace Perinatal (ISP) (v. J.x, K.x)
Access CT6 Slice (v2.0.0.31538)
DR Compact (v3.1)
Intellispace Critical Care and Anesthesia ICCA (v. H.x, J,x)*
Achieva, Achieva 3.0T and Achieva XR (vR5.3, R5.4 and higher)
DuraDiagnost (v3.0.0-4.0.7)
IntelliVue Guardian Software(vE.0x)*
Affiniti 30/50/70
DuraDiagnost Compact (v2.1.0-2.1.3)
IQon Spectral CT (v4.7.2, 4.7.5, 4.7.7)
Big Bore/Big Bore RT (v4.2, 4.8)
DuraDiagnost F30
IU22
Brilliance 64 (v4.1.6, 4.1.7, 4.1.10)
Easy Diagnost (v5.1.0-5.1.1)
Juno DFR 5.7
Brilliance ICT (v4.1.6, 4.1.7)
eICU eCare Manager*
Microdose S0 (Balder) 11.0 and MicroDose SI & SI U (L50 & L50 U) 9.0 P1, P2, P3, P4, P5
Brilliance ICT SP (v4.1.6)
Emergency Care Informatics
(v2)**
MobileDiagnost M50, Opta and wDR (1.2-2.10)
Care Orchestrator (v1)
Encore Anywhere (v2.41)
Multi-Patient Bridge (v1.0.0.1)
ClearVue
Epiq 5/7
Multiva and Multiva/Prodiva R5.3 and R5.4 and higher
Clinical Collaboration Platform (VuePACS)
FocalPoint A.0/A.01*
PIC iX (B.0x, C.0x)
CombiDiagnost R90 (v1.0.0-1.0.1.1, 1.0.0.2, 1.01, 1.0.1.1)
Graph Mammo
Prograde (v1.0.0-1.2)
Corsium
IE33
ProxiDiagnost N90
CT5000 Ingenuity (v4.1.10)
IIT Reacts
RIS (formally known as Vue) 11.3
CT 6000 iCT (v4.1.10)
Ingenia (vR5.3, R5.4 and higher)
Sleep Support Portal & PSPNet
CT MX16 EV02 (v2.0)
Ingenuity (v4.0.0-4.1.7)
Sparq
CX50/30
IntelliSpace Breast (v2.1, 2.2, 3.1, and 3.2)
SPhAERA (v3.0 and higher)
Diagnostics Site Server (DSS)**
Intellispace Consultative Criticl Care (ICCC) (vB.02)
ST80i A.02 (v2.05)
DigitalDiagnost (v3.2.0-4.2)
Intellispace ECG (IECG) (vB.00)*
Vereos (v2.0x)

*Software only products with customer owned Operating Systems. For products solutions where the server was provided, it is customer responsibility to validate and deploy patches.

**Information or patch available in Incenter.

***Philips hosting business is in the process of validating and deploying the patch to the managed infrastructure.

 

End Update B

 

Begin Update A: 2021 March 2

Achieva, Achieva 3.0T and Achieva XR (R5.3, R5.4 and higher)
DuraDiagnost F30
Microdose S0 (Balder) 11.0 and MicroDose SI & SI U (L50 & L50 U) 9.0 P1, P2, P3, P4, P5
Affiniti 30/50/70
Easy Diagnost (5.1.0-5.1.1)
MobileDiagnost M50, Opta and wDR (1.2-2.10)
ClearVue
Epiq 5/7
Multiva and Multiva/Prodiva R5.3 and R5.4 and higher
Clinical Collaboration Platform (VuePACS)
Graph Mammo
Prograde (1.0.0-1.2)
CombiDiagnost R90 (v1.0.0-1.0.1.1)
IE33
ProxiDiagnost N90
CX50/30
IIT Reacts
RIS (formally known as Vue) 11.3
DigitalDiagnost (v3.2.0-4.2)
Ingenia (R5.3, R5.4 and higher)
Sparq
DigitalDiagnost C50, C90 and Opta C50 (v1.x.x)
IntelliSpace Breast (2.1, 2.2, 3.1, and 3.2)
SPhAERA (3.0 and higher)
DR Compact (3.1)
IntellisPace Perinatal (ISP) (VJ.x, K.x)
DuraDiagnost (3.0.0-4.0.7)
IU22
DuraDiagnost Compact (2.1.0-2.1.3)
Juno DFR 5.7

*Software only products with customer owned Operating Systems. For products solutions where the server was provided, it is customer responsibility to validate and deploy patches.

**Information or patch available in Incenter.

***Philips hosting business is in the process of validating and deploying the patch to the managed infrastructure.

 

End Update A