Security News > 2021 > July > Critical Flaws Reported in Philips Vue PACS Medical Imaging Systems
Multiple security vulnerabilities have been disclosed in Philips Clinical Collaboration Platform Portal, some of which could be exploited by an adversary to take control of an affected system.
"Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or affect system data integrity in such a way as to negatively impact the confidentiality, integrity, or availability of the system," the U.S. Cybersecurity and Infrastructure Security Agency noted in an advisory.
Four of the issues have been given a Common Vulnerability Scoring System base score of 9.8, and concern improper validation of input data as well as vulnerabilities introduced by flaws previously patched in Redis.
Another serious flaw is caused by the Vue platform's use of cryptographic keys beyond their established expiration date, "Which diminishes its safety significantly by increasing the timing window for cracking attacks against that key."
While Philips has addressed some of the shortcomings as part of its updates shipped in June 2020 and May 2021, the Dutch healthcare company is expected to patch the rest of the security issues in version 15 of Speech, MyVue, and PACS that's currently in development and set for release in Q1 2022.
In the interim, CISA is urging entities to minimize network exposure for all control system devices and ensure that they are not accessible from the Internet, segment control system networks and remote devices behind firewalls, and use virtual private networks for secure remote access.