Philips Interventional Workstations OS Command Injection
Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component.
Philips has released a software patch to proactively address this
vulnerability in the installed base and will schedule service activities
with impacted users to implement the correction. As a mitigation for
this vulnerability, users with expertise are advised to change the IPMI
password for the workstation interface.
Users with questions regarding specific Philips Interventional
Workspot and/or installations and correction eligibility should contact a
Philips service support team, regional service support https://www.usa.philips.com/healthcare/solutions/customer-service-solutions
, or call 1-800-722-9377 with reference to field change order (FCO) number 2019-IGTBST-014.
Please see the Philips product security website https://www.philips.com/productsecurity
for the Philips advisory and the latest security information for Philips products.