Please find our Security Advisories here

Publication Date: 2021 December 13

Update Date: 2022 March 9

Philips is currently monitoring developments and updates related to the recently released Apache advisory. Apache has confirmed that a critical Remote Code Execution vulnerability (CVE-2021-44228) exists in their Log4j utility. Log4j is an open source, java-based logging utility.

As part of the company’s product security policy and protocols, Philips teams are evaluating Philips’s products and solutions utilizing Apache’s Log4j utility for potential impacts from this reported vulnerability and validating actions.

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise) are encouraged to contact their local service support team or regional product service support as appropriate for up-to-date information specific to their Philips’ products. https://incenter.medical.philips.com

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products that could be vulnerable to CVE-2021-44228. However, the list below is not comprehensive and may be updated as necessary if more products are identified.

Publication Date: 2021 December 10

Update Date: 2021 December 13

Philips is currently monitoring developments and updates related to recently released reports that confirm an active exploitation of a previously fixed server-side request forgery vulnerability (CVE-2021-40438) in Apache’s HTTP Server. The vulnerability impacts HTTP Server versions 2.4.48 and earlier. Apache had released a new version (2.4.49) to fix this vulnerability back in September 2021.

As part of the company’s product security policy and protocols, Philips teams are evaluating Philips’s products and solutions utilizing Apache’s vulnerable products for potential impacts from this reported vulnerability and validating actions.

Begin Update A: 2021 December 13

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products that could be vulnerable to CVE-2021-40438. However, the list below is not comprehensive and may be updated as necessary if more products are identified.

Publication Date: 2021 November 18

Update Date: 2022 January 27

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.  

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding a potential issue related to certain versions of Philips IntelliBridge EC40 and EC80 systems (C.00.04 and prior).

Philips has identified that the affected software contains hard-coded credentials and authentication bypass using an alternate path or channel.

Philips’ analysis has shown that these issues require a low skill level to exploit. Successful exploitation of these issues may allow an attacker unauthorized access to the Philips IntelliBridge EC40/80 hub and may allow access to execute software, modify device configuration, or view/update files, including unidentifiable patient data. The vulnerabilities can potentially be exploited over the Philips patient monitoring network, which is required to be physically or logically isolated from the hospital local area network (LAN).

To date, Philips has not received any reports of exploitation of these issues or of incidents from clinical use that we have been able to associate with these issues. It is unlikely that this potential vulnerability would impact clinical use, as the Philips IntelliBridge EC40/80 hub is not intended for use in connection with active patient monitoring.

Philips released software updates in Q4 2021 which is referenced in FCO86201952A, and has controlling mitigations on the affected software to limit the risk and exploitability of this potential vulnerability.

Philips has reported the potential vulnerabilities and their mitigations to the public and to the appropriate government agencies, including the U.S. Cybersecurity Infrastructure and Security Agency (CISA), which is issuing an advisory.

Users with questions regarding their specific the Philips IntelliBridge EC40/80 solutions are advised by Philips to contact their local Philips service support team.

ICSMA-21-322-01 Philips IntelliBridge EC40-80: https://us-cert.cisa.gov/ics/advisories/icsma-21-322-01

Publication Date: 2021 November 18

Update Date: 2023 June 9

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding a potential issue related to certain versions of Philips Patient Information Center iX (PIC iX) and Efficia CM Series software.

Philips has identified vulnerabilities in the affected software including:

• Improper input validation (CWE-20), affecting Patient Information Center iX (PIC iX) versions C.02, C.03
• Use of a hard-coded cryptographic key (CWE-321), affecting Patient Information Center iX (PIC iX) versions B.02, C.02, C.03
• Insecure cryptographic algorithm (CWE-327), affecting Patient Information Center iX (PICiX) version C.0x and Effica CM Series revisions A.01 to C.0x.

To date, Philips has not received any reports of exploitation of these issues or of incidents from clinical use that we have been able to associate with these issues. At this time there are no known public exploits that specifically target these vulnerabilities.

Successful exploitation of these vulnerabilities may allow an attacker unauthorized access to data (including patient data) and denial of service resulting in temporary interruption of viewing of physiological data at the central station. Exploitation does not enable modification or change to point of care devices.

Philips released a remediation for CWE-20 in Q3 2021 in PIC iX C.03.06. Philips released a remediation for CWE-321 & CWE-327 in Q2 of 2023 in PIC iX 4.1. Users should operate all Philips deployed and supported products within Philips authorized specifications, including Philips approved software, software configuration, system services, and security configuration.

As an interim mitigation, Philips recommends the following which are outlined in the Philips Patient Monitoring System Security for Clinical Networks guide for additional information on InCenter:

• Philips-provided hardware ships with Bitlocker Drive Encryption enabled by default to protect the data at rest stored on the system.  It should not be disabled.
• Philips recommends that customers follow NIST SP 800-88 for media sanitization prior to system disposal.
• By default, patient information is not included in archives.  When exporting archives that contain patient information, customers should store securely with strong access controls.
• The Philips patient monitoring network is required to be physically or logically isolated from the hospital local area network (LAN). Philips recommends using a firewall or routers that can implement access control lists restricting access in and out of the patient monitoring network for only necessary ports and IP addresses. 

Philips has reported the potential vulnerabilities and their mitigations to the public and to the appropriate government agencies, including the U.S. Cybersecurity Infrastructure and Security Agency (CISA), which is issuing an advisory.

Users with questions regarding their specific the Philips Patient Information Center iX (PIC iX) and Efficia CM Series solutions are advised by Philips to contact their local Philips service support team.

ICSMA-21-322-02 Philips Patient Information Center iX (PIC iX) and Efficia CM Series: https://us-cert.cisa.gov/ics/advisories/icsma-21-322-02

Publication Date: 2021 November 10

Update Date: 2021 November 10

Philips is currently monitoring developments and updates related to the recently published Cybersecurity and Infrastructure Security Agency (CISA) advisory (ICSA-21-313-03) concerning 13 reported vulnerabilities and referred to as NUCLEUS:13. These vulnerabilities are found in the TCP/IP stack and related services (FTP, TFTP) of the networking component (Nucleus NET) in the Nucleus Real-Time Operating Systems (RTOS). According to CISA, Successful exploitation of these vulnerabilities could cause a denial-of-service condition, allow an information leakage, or remote code execution.

As part of the company’s product security policy and protocols, Philips teams are evaluating Philips’s products and solutions utilizing Siemens’s vulnerable products for potential impacts from these reported vulnerabilities and validating actions.

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips’ products (including operating system security updates and patches) may be implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions.

When a product does require security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation will be produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise) are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products.

At this time, no Philips products are known to be impacted. In accordance with Philips’ Global Security Policy, Philips continues to analyze the matter, and further information will be posted on the Philips Product Security Advisory page as appropriate.

Publication Date: 2021 June 29 

Update Date:  2023 February 16

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.
 

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding potential issues related to the certain versions Philips Vue PACS (Picture Archiving and Communications System) software and related products:
 

• Vue PACS versions 12.2.x.x and prior
• Vue MyVue versions 12.2.x.x and prior
• Vue Speech versions 12.2.x.x and prior
•  Vue Motion versions 12.2.1.5 and prior
   

Philips has identified potential security vulnerabilities that under specific conditions could impact or potentially compromise patient confidentiality, system integrity, and/or system availability. To minimize the potential risk of these vulnerabilities, Philips recommends that users upgrade to the latest Philips Vue PACS software running on Windows Operating System 2019 and enabling security patching procedures for timely security updates. Philips’ analysis has shown that these issues require a range of low skill to high skill to exploit. In this event, unauthorized users may be able to provide unexpected input into the application, execute arbitrary code, alter the intended control flow of the system, access sensitive information, or potentially cause a system crash. Philips has identified that some of the affected vulnerabilities could be attacked remotely. Exploits that could target some of the vulnerabilities are known to be publicly available.

To date, Philips has not received any reports of exploitation of these issues or of incidents from clinical use that we have been able to associate with this issue. It is unlikely that this potential vulnerability would impact clinical use. Philips released software updates and has controlling mitigations on the affected software to limit the risk and exploitability of most of these vulnerabilities.

Philips has reported these potential vulnerabilities and its resolution to customers and the appropriate government agencies, including the U.S. Cybersecurity Infrastructure and Security Agency (CISA), which is issuing an advisory.

Users with questions regarding their specific Vue PACS solutions are advised by Philips to contact their local Philips service support team. Please see the Philips product security web site for the latest security information for Philips products: https://www.philips.com/productsecurity

ADDENDUM: In January 2022, Philips added one low-severity vulnerability report (CWE-23) to the original July 2021 Coordinated Vulnerability Disclosure posted by CISA in July 2021. This additional vulnerability did not alter the overall CvSS3 Score for the reported vulnerabilities in this product.

ADDENDUM 2: In March 2022, Philips updated the advisory to announce earlier versions than originally planned were released that remediated CWE-665 and CWE-327 for Speech. Also, 12.2.8.100 was released in Q1 of 2022 that remediates CWE-665 and CWE-710 for MyVue, CWE-79, CWE-693, CWE-665, CWE-1188, CWE-327, CWE-176, CWE-522, CWE-710, and CWE-707 for PACS. CWE-522 with a low CVSS score will be remediated in Q3 of 2023.

ADDENDUM 3: In February 2023, Philips updated the advisory to note that CWE-23 had been remediated in December 2021 with the released version of 12.2.1.6 for VuePAC (WFM), Vue Motion (Enterprise Viewer), Vue Explorer, and Web System Configuration.

Cybersecurity & Infrastructure Security Agency (CISA) Advisory: https://us-cert.cisa.gov/ics/advisories/icsma-21-187-01

Publication Date: 2021 June 24 

Update Date:  2021 June 24
 

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding a potential issue related to the certain versions of Philips Interoperability Solutions XDS (Software Versions 2.5 to 3.11 and 2018-1 to 2021-1).

Philips has identified a potential low-severity security vulnerability that requires a high skill level to exploit, and for which there are no known public exploits available. A highly motivated attacker can read the Lightweight Directory Access Protocol (LDAP) system credentials by gaining access to the network channel being used for communication.  Should this occur, clear text transmission of sensitive information risk applies to configurations which are configured to use LDAP via Transport Layer Security (TLS).

To minimize the potential risk of these vulnerabilities, Philips has identified the following guidance and mitigations:
 

• Administrators  should disable LDAP referrals on their LDAP servers if LDAP via TLS is used.
• Administrators should configure their LDAP servers to include a complete structure to search.
   

The Philips software is not be used for clinical use nor rated as a medical device; therefore, this potential vulnerability would not impact patient safety.
 

Philips has reported this potential vulnerability and its  mitigation to customers and the appropriate government agencies, including the U.S. Cybersecurity Infrastructure and Security Agency (CISA), which is issuing an advisory.
 

Users with questions regarding their specific Interoperability Solutions XDS installations are advised by Philips to contact their local Philips service support team. Philips contact information is available at the following location:  https://www.usa.philips.com/healthcare/solutions/customer-service-solutions or call 1-800-722-9377

Publication on Cybersecurity & Infrastructure Security Agency (CISA) website: https://us-cert.cisa.gov/ics/advisories/icsma-21-175-01

Publication Date: 2021 May 20 

Update Date: 2021 May 24

Philips is currently monitoring developments and updates related to the Federal Bureau of Investigation (FBI) (CP-000147-MW). The FBI identified at least 16 Conti ransomware attacks targeting US healthcare and first responder networks, including law enforcement agencies, emergency medical services, 9-1-1 dispatch centers, and municipalities within the last year. These healthcare and first responder networks are among the more than 400 organizations worldwide victimized by Conti, over 290 of which are located in the U.S. Like most ransomware variants, Conti typically steals victims’ files and encrypts the servers and workstations in an effort to force a ransom payment from the victim. The ransom letter instructs victims to contact the actors through an online portal to complete the transaction. If the ransom is not paid, the stolen data is sold or published to a public site controlled by the Conti actors. Ransom amounts vary widely and we assess are tailored to the victim. Recent ransom demands have been as high as $25 million. 

Conti actors gain unauthorized access to victim networks through weaponized malicious email links, attachments, or stolen Remote Desktop Protocol (RDP) credentials. Conti actors use remote access tools, which most often beacon to domestic and international virtual private server (VPS) infrastructure over ports 80, 443, 8080, and 8443. Additionally, actors may use port 53 for persistence. Large HTTPS transfers go to cloud-based data storage providers MegaNZ and pCloud servers. Other indicators of Conti activity include the appearance of new accounts and tools—particularly Sysinternals—which were not installed by the organization, as well as disabled endpoint detection and constant HTTP and domain name system (DNS) beacons, and disabled endpoint detection.

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips’ products (including operating system security updates and patches) may be implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions.

If a product does require operating system security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise) are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products.

Begin Update A: 24 May 2021

At this time, no Philips products or solutions are impacted. If we become aware of an affected product or solution, we will post that information here.

For customers who utilize the Remote Services Network (RSN, PRS), all Philips RSN systems are protected against this vulnerability and customers are advised not to disconnect the PRS as it may impact Philips service teams from providing any required immediate and proactive support such as remote patching.

End Update A

Publication Date: 2021 May 4

Update Date: 2021 May 4

Philips is currently monitoring developments and updates related to the Cybersecurity & Infrastructure Security Agency (CISA) advisory (AA21-110A).

CISA partners have observed active exploitation of vulnerabilities in Ivanti’s Pulse Connect Secure products. Successful exploitation of these vulnerabilities allows an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. Ivanti has provided a mitigation and is in the process of developing a patch.

At this time, no Philips products are impacted. If we become aware of an affected product, we will post that information here.

Publication Date: 2021 April 15

Update Date: 2021 April 30

Philips is currently monitoring developments and updates related to nine DNS vulnerabilities reported by cybersecurity researchers from Forescout and JSOF. The set of nine vulnerabilities, referred to as NAME:WRECK affect Domain Name System (DNS) implementations which affect at least four common TCP/IP stacks – FreeBSD, IPNet, NetX and Nucleus NET.

As part of the company’s product security policy and protocols, Philips’ teams are evaluating Philips’ products and solutions utilizing DNS with affected TCP/IP stacks for potential impacts from these reported vulnerabilities and validating actions.

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips’ products (including operating system security updates and patches) may be implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions.

When a product does require security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation will be produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise) are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products.

Begin Update A: 2021 April 30

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products vulnerable to the NAME:WRECK vulnerabilities. However, the list below is not comprehensive and may be updated as necessary if more products are identified.

Publication Date: 2021 March 25 

Update Date:  2021 March 25

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.  

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding a very low-severity issue related to Philips Gemini PET/CT Family systems (CVSS v3 Score – 2.4 on a scale of 10).

This potential issue is related to storage of information in a file system or device without access control, specific to removable media. Should this issue be exploited, there is a possibility that sensitive information may be accessible by unauthorized parties. This potential vulnerability requires physical access to the removable media to exploit.

To date, Philips has not received any reports of exploitation of these issues or of incidents from clinical use that we have been able to associate with this issue.

Philips is reminding customers that users should operate all Philips deployed and supported Gemini PET/CT systems within Philips authorized specifications, including Philips approved software, software configuration, system services, and security configuration.

Customers with questions regarding their specific Philips Gemini PET/CT installations should contact their Philips support representative, visit the customer service solutions web site at https://www.usa.philips.com/healthcare/solutions/customer-service-solutions, or call 1-800-722-9377.

Publication on Cybersecurity & Infrastructure Security Agency (CISA) website: https://us-cert.cisa.gov/ics/advisories/icsma-21-084-01

Publication Date: 2021 March 10

Update Date: 2021 March 12 

Philips is currently monitoring developments and updates related to the recent F5 alert concerning four critical CVEs, along with three related CVEs (two highs and one medium).

As part of the company’s product security policy and protocols, Philips’ teams are evaluating Philips’ products and solutions utilizing F5 for potential impacts from these reported vulnerabilities and validating actions. F5 has released a patch to help remediate this vulnerability. Philips is currently in the process of validating the F5 patch and vendor recommended mitigation options. Once the F5 patch has been tested and validated by Philips with the impacted products, the patch will either be installed by Philips or made available for installation by customers, depending on contract details.

Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips’ products (including operating system security updates and patches) may be implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions.

When a product does require security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation will be produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.

Contract-entitled customers may use Philips InCenter and are encouraged to request Philips InCenter access and reference product-specific information posted. If customers still have questions, all customers (contract-entitled or otherwise) are encouraged to contact their local service support team or regional product service support as appropriate for up to date information specific to their Philips’ products.

Begin Update A: March 12, 2020

Philips is providing the list below in order to better assist our customers in identifying any Philips’ products vulnerable to CVE-2021-22986, CVE-2021-22987, CVE-2021-22991, CVE-2021-22992. However, the list below is not comprehensive and may be updated as necessary if more products are identified. It does not indicate the patch or device status.

*Software only products with customer owned Operating Systems

**Information or patch available in Incenter

***Philips hosting business is in the process of validating and deploying the patch to the managed infrastructure
 

End Update A   

Publication Date: 2021 March 8 

Update Date: 2021 March 15 

Philips is currently monitoring developments and updates related to the Cybersecurity & Infrastructure Security Agency (CISA) advisory (AA21-062A). CISA partners have observed active exploitation of vulnerabilities in Microsoft Exchange Server products. Successful exploitation of these vulnerabilities allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system.

Successful exploitation may additionally enable the attacker to compromise trust and identity in a vulnerable network. Microsoft released out-of-band patches to address vulnerabilities in Microsoft Exchange Server. The vulnerabilities impact on-premises Microsoft Exchange Servers and are not known to impact Exchange Online or Microsoft 365 (formerly O365) cloud email services.

At this time, no Philips products are impacted. If we become aware of an affected product, we will post that information here.

Publication Date: 2021 January 19 

Update Date: 2021 January 19

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive, ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities. 

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible security vulnerabilities, the company is proactively issuing an advisory regarding software versions of Philips Interventional WorkSpot, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, and ViewForum running on older Haswell workstations. 

Philips has become aware of a potential moderate-severity security vulnerability in affected systems. This potential vulnerability requires access to the hospital network to exploit. Should successful exploitation occur, there is a possibility that an attacker already within the hospital network could potentially shut down or restart the workstation. In the event that the workstation is remotely shut down, physicians are still able to use diagnostic imaging from the X-ray system. 

To date, Philips has not received any reports of exploitation of these issues or of incidents from clinical use that we have been able to associate with this issue. Philips has released a software patch to proactively address this vulnerability in the installed base and will schedule service activities with impacted customers to implement the correction. As a mitigation for this potential security vulnerability, customers with expertise are advised to change the IPMI password for the workstation interface. 

Customers with questions regarding their specific Philips Interventional WorkSpot, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, and ViewForum installations should contact their Philips support representative or call 1-800-722-9377 with reference to field change order (FCO) number FCO72200452.

Cybersecurity & Infrastructure Security Agency (CISA) Advisory: Philips Interventional Workstations | CISA