Philips Intellispace Cardiovascular (ISCV)
Plan Patch7.7ICS-CERT ICSMA-25-072-01Mar 13, 2025
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Intellispace Cardiovascular versions 4.1 and earlier, and 5.1 and earlier, contain session replay vulnerabilities (CVE-2025-2229, CVE-2025-2230) that allow attackers with local network access to capture and replay user sessions. Successful exploitation grants unauthorized access to patient medical records and cardiac imaging data without authentication. The vulnerabilities are not remotely exploitable and require local or adjacent network proximity. Philips has released fixes in ISCV 4.2 (May 2019) and ISCV 5.2 (September 2020), with the current version being 8.0.0.0.
What this means
What could happen
An attacker with local access to an Intellispace Cardiovascular workstation could replay the session of a logged-in user to gain unauthorized access to patient medical records and cardiac imaging data without needing their credentials.
Who's at risk
Healthcare facilities and medical device management teams operating Philips Intellispace Cardiovascular systems for cardiac imaging and patient record management. This includes hospital IT/clinical engineering staff responsible for cardiology departments, imaging centers, and any facility using ISCV 4.1 or earlier, or 5.1 or earlier, for patient care and data storage.
How it could be exploited
An attacker with physical or local network access to an ISCV workstation can capture and replay the session tokens of an authenticated user. This allows them to impersonate that user and access the same patient records and clinical data the legitimate user had open, without needing to know the user's password.
Prerequisites
- Local or adjacent network access to the ISCV workstation
- An active user session on the target ISCV workstation
- Ability to capture network traffic or access session data on the local network segment
No authentication required once session is capturedLow complexity attackAffects patient privacy and medical records confidentialityNo patch available for ISCV versions 4.1 and 5.1
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Intellispace Cardiovascular (ISCV): <=4.1≤ 4.14.2 build 20589
Intellispace Cardiovascular (ISCV): <=5.1≤ 5.14.2 build 20589
Remediation & Mitigation
0/6
Do now
0/3Intellispace Cardiovascular (ISCV): <=4.1
HARDENINGIsolate ISCV workstations and servers from the general business network using network segmentation or firewalls
HARDENINGRestrict direct network access to ISCV systems to authorized clinical staff only; block access from non-clinical network segments
WORKAROUNDImplement session timeout policies to automatically log out idle ISCV users
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
Intellispace Cardiovascular (ISCV): <=4.1
HARDENINGRequire multi-factor authentication (MFA) for ISCV user sessions if the application supports it
All products
HOTFIXUpgrade Intellispace Cardiovascular 4.x installations to version 4.2 (build 20589) or later
HOTFIXUpgrade Intellispace Cardiovascular 5.x installations to version 5.2 (released September 2020) or latest version 8.0.0.0
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/b752a54d-a0f7-4c41-bbec-15bacf4b4a02